PasswordBox.SecurePassword
得到SecureString
密码的,但我需要能够在两个PasswordBoxes的内容,以确保平等之前,我接受密码。然而,两个相同的SecureStrings被视为不相等:var secString1 = new SecureString();var secString2 = new SecureString();foreach (char c in "testing"){ secString1.AppendChar(c); secString2.AppendChar(c);}Assert.AreEqual(secString1, secString2); // This fails
我是Password
该PasswordBoxes物业有违仅访问点SecurePassword
安全性? 编辑:基于这个问题 CodeGo.net,我检查了关于“使用Marshal类来转换的SecureString为ANSI或Unicode或一个BSTR”,那么也许我的这个博客帖子。SecureStrings
。 不安全的代码来遍历字符串:bool SecureStringEqual(SecureString s1, SecureString s2) { if (s1 == null) { throw new ArgumentNullException("s1"); } if (s2 == null) { throw new ArgumentNullException("s2"); } if (s1.Length != s2.Length) { return false; } IntPtr bstr1 = IntPtr.Zero; IntPtr bstr2 = IntPtr.Zero; RuntimeHelpers.PrepareConstrainedRegions(); try { bstr1 = Marshal.SecureStringToBSTR(s1); bstr2 = Marshal.SecureStringToBSTR(s2); unsafe { for (Char* ptr1 = (Char*)bstr1.ToPointer(), ptr2 = (Char*)bstr2.ToPointer(); *ptr1 != 0 && *ptr2 != 0; ++ptr1, ++ptr2) { if (*ptr1 != *ptr2) { return false; } } } return true; } finally { if (bstr1 != IntPtr.Zero) { Marshal.ZeroFreeBSTR(bstr1); } if (bstr2 != IntPtr.Zero) { Marshal.ZeroFreeBSTR(bstr2); } } }
我已经修改了它下面没有不安全的代码工作(但是请注意,你可以在调试的时候看到的字符串以纯文本): Boolean SecureStringEqual(SecureString secureString1, SecureString secureString2) { if (secureString1 == null) { throw new ArgumentNullException("s1"); } if (secureString2 == null) { throw new ArgumentNullException("s2"); } if (secureString1.Length != secureString2.Length) { return false; } IntPtr ss_bstr1_ptr = IntPtr.Zero; IntPtr ss_bstr2_ptr = IntPtr.Zero; try { ss_bstr1_ptr = Marshal.SecureStringToBSTR(secureString1); ss_bstr2_ptr = Marshal.SecureStringToBSTR(secureString2); String str1 = Marshal.PtrToStringBSTR(ss_bstr1_ptr); String str2 = Marshal.PtrToStringBSTR(ss_bstr2_ptr); return str1.Equals(str2); } finally { if (ss_bstr1_ptr != IntPtr.Zero) { Marshal.ZeroFreeBSTR(ss_bstr1_ptr); } if (ss_bstr2_ptr != IntPtr.Zero) { Marshal.ZeroFreeBSTR(ss_bstr2_ptr); } } }
public static bool IsEqualTo(this SecureString ss1, SecureString ss2){ IntPtr bstr1 = IntPtr.Zero; IntPtr bstr2 = IntPtr.Zero; try { bstr1 = Marshal.SecureStringToBSTR(ss1); bstr2 = Marshal.SecureStringToBSTR(ss2); int length1 = Marshal.ReadInt32(bstr1, -4); int length2 = Marshal.ReadInt32(bstr2, -4); if (length1 == length2) { for (int x = 0; x < length1; ++x) { byte b1 = Marshal.ReadByte(bstr1, x); byte b2 = Marshal.ReadByte(bstr2, x); if (b1 != b2) return false; } } else return false; return true; } finally { if (bstr2 != IntPtr.Zero) Marshal.ZeroFreeBSTR(bstr2); if (bstr1 != IntPtr.Zero) Marshal.ZeroFreeBSTR(bstr1); }}
编辑:固定泄漏的由Alex J.联系客服