.netsecuritydesign-patternscode-security

How to ensure that a method can only be called from a specific dll


I need to prepare my database for unit testing and hence in the set up method I want to get rid of the data.

However, I don't want to be anybody else but the unit test dll to be able to call into my DeleteAllData() method in my Data Access Layer. What can be done?


Solution

  • While others already suggested how to restrict code making calls to your method, they do not create a security boundary and can be spoofed (unless you sign both assemblies and verify the evidence).

    Having a method in your business logic called DeleteAllData sounds pretty scary to me. If this method is only used from a unit test, I would probably move it to the unit test assembly. If that is not possible, I would at least put the code in a compiler directive to only compile in debug mode.