C#idiomatic C#
ca2119fundamentals/code-analysis/quality-rules

Code analysis

CA2119: Seal methods that satisfy private interfaces

Learn about code analysis rule CA2119: Seal methods that satisfy private interfaces

CA2119 Security enabled by default in .NET 10: No
Fix is breaking or non-breaking BreakingApplicable languages C# and Visual Basic

Cause

An inheritable public type provides an overridable method implementation of an internal (Friend in Visual Basic) interface.

Rule description

Interface methods have public accessibility, which cannot be changed by the implementing type. An internal interface creates a contract that is not intended to be implemented outside the assembly that defines the interface. A public type that implements a method of an internal interface using the virtual (Overridable in Visual Basic) modifier allows the method to be overridden by a derived type that is outside the assembly. If a second type in the defining assembly calls the method and expects an internal-only contract, behavior might be compromised when, instead, the overridden method in the outside assembly is executed. This creates a security vulnerability.

How to fix violations

To fix a violation of this rule, prevent the method from being overridden outside the assembly by using one of the following:

  • Make the declaring type sealed (NotInheritable in Visual Basic).

  • Change the accessibility of the declaring type to internal (Friend in Visual Basic).

  • Remove all public constructors from the declaring type.

  • Implement the method without using the virtual modifier.

  • Implement the method explicitly.

When to suppress warnings

It is safe to suppress a warning from this rule if, after careful review, no security issues exist that might be exploitable if the method is overridden outside the assembly.

Suppress a warning

If you just want to suppress a single violation, add preprocessor directives to your source file to disable and then re-enable the rule.

csharp
#pragma warning disable CA2119
// The code that's violating the rule is on this line.
#pragma warning restore CA2119

To disable the rule for a file, folder, or project, set its severity to none in the configuration file.

ini
[*.{cs,vb}]
dotnet_diagnostic.CA2119.severity = none

For more information, see How to suppress code analysis warnings.

Example 1

The following example shows a type, BaseImplementation, that violates this rule.

sample · csharpdocs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca2119.cssnippet1

csharp
using System;

namespace ca2119
{
    //<snippet1>
    // Internal by default.
    interface IValidate
    {
        bool UserIsValidated();
    }

    public class BaseImplementation : IValidate
    {
        public virtual bool UserIsValidated()
        {
            return false;
        }
    }

    public class UseBaseImplementation
    {
        public void SecurityDecision(BaseImplementation someImplementation)
        {
            if (someImplementation.UserIsValidated() == true)
            {
                Console.WriteLine("Account number & balance.");
            }
            else
            {
                Console.WriteLine("Please login.");
            }
        }
    }
    //</snippet1>
}

namespace ca2119_2
{
    //<snippet2>
    public class BaseImplementation
    {
        public virtual bool UserIsValidated()
        {
            return false;
        }
    }

    public class UseBaseImplementation
    {
        public void SecurityDecision(BaseImplementation someImplementation)
        {
            if (someImplementation.UserIsValidated() == true)
            {
                Console.WriteLine("Account number & balance.");
            }
            else
            {
                Console.WriteLine("Please login.");
            }
        }
    }
    //</snippet2>
}

sample · vbdocs/fundamentals/code-analysis/quality-rules/snippets/vb/all-rules/ca2119-seal-methods-that-satisfy-private-interfaces_1.vbsnippet1

vb
Imports System

Namespace ca2119
    '<snippet1>
    Interface IValidate
        Function UserIsValidated() As Boolean
    End Interface

    Public Class BaseImplementation
        Implements IValidate

        Overridable Function UserIsValidated() As Boolean _
         Implements IValidate.UserIsValidated
            Return False
        End Function

    End Class

    Public Class UseBaseImplementation

        Sub SecurityDecision(someImplementation As BaseImplementation)

            If (someImplementation.UserIsValidated() = True) Then
                Console.WriteLine("Account number & balance.")
            Else
                Console.WriteLine("Please login.")
            End If

        End Sub

    End Class
    '</snippet1>
End Namespace

Namespace ca2119_2
    '<snippet2>
    Public Class BaseImplementation

        Overridable Function UserIsValidated() As Boolean
            Return False
        End Function

    End Class

    Public Class UseBaseImplementation

        Sub SecurityDecision(someImplementation As BaseImplementation)

            If (someImplementation.UserIsValidated() = True) Then
                Console.WriteLine("Account number & balance.")
            Else
                Console.WriteLine("Please login.")
            End If

        End Sub

    End Class
    '</snippet2>

End Namespace

Example 2

The following example exploits the virtual method implementation of the previous example.

sample · csharpdocs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca2119.cssnippet2

csharp
using System;

namespace ca2119
{
    //<snippet1>
    // Internal by default.
    interface IValidate
    {
        bool UserIsValidated();
    }

    public class BaseImplementation : IValidate
    {
        public virtual bool UserIsValidated()
        {
            return false;
        }
    }

    public class UseBaseImplementation
    {
        public void SecurityDecision(BaseImplementation someImplementation)
        {
            if (someImplementation.UserIsValidated() == true)
            {
                Console.WriteLine("Account number & balance.");
            }
            else
            {
                Console.WriteLine("Please login.");
            }
        }
    }
    //</snippet1>
}

namespace ca2119_2
{
    //<snippet2>
    public class BaseImplementation
    {
        public virtual bool UserIsValidated()
        {
            return false;
        }
    }

    public class UseBaseImplementation
    {
        public void SecurityDecision(BaseImplementation someImplementation)
        {
            if (someImplementation.UserIsValidated() == true)
            {
                Console.WriteLine("Account number & balance.");
            }
            else
            {
                Console.WriteLine("Please login.");
            }
        }
    }
    //</snippet2>
}

sample · vbdocs/fundamentals/code-analysis/quality-rules/snippets/vb/all-rules/ca2119-seal-methods-that-satisfy-private-interfaces_1.vbsnippet2

vb
Imports System

Namespace ca2119
    '<snippet1>
    Interface IValidate
        Function UserIsValidated() As Boolean
    End Interface

    Public Class BaseImplementation
        Implements IValidate

        Overridable Function UserIsValidated() As Boolean _
         Implements IValidate.UserIsValidated
            Return False
        End Function

    End Class

    Public Class UseBaseImplementation

        Sub SecurityDecision(someImplementation As BaseImplementation)

            If (someImplementation.UserIsValidated() = True) Then
                Console.WriteLine("Account number & balance.")
            Else
                Console.WriteLine("Please login.")
            End If

        End Sub

    End Class
    '</snippet1>
End Namespace

Namespace ca2119_2
    '<snippet2>
    Public Class BaseImplementation

        Overridable Function UserIsValidated() As Boolean
            Return False
        End Function

    End Class

    Public Class UseBaseImplementation

        Sub SecurityDecision(someImplementation As BaseImplementation)

            If (someImplementation.UserIsValidated() = True) Then
                Console.WriteLine("Account number & balance.")
            Else
                Console.WriteLine("Please login.")
            End If

        End Sub

    End Class
    '</snippet2>

End Namespace

See also