I’m trying to test the security of an app that I’m building. In it, it concatenates the resulting string from File.ReadAllText with another large string. Would it be possible to, say, sneak in a text file with something like this- “; //malicious code// string+=” -in order to inject code by breaking out of the string and appending code after? Using the above example, it looks like either file.ReadAllText is escaping the double quotes preventing code injection, or that it doesn’t see the double quotes in the same way that the compiler would.
I know this is super niche, but if anyone has insight on this function, I would greatly appreciate it.
Tried reading a text file with-
“; Console.WriteLine(“Alert”); string test = “
but it manages to escape/read it as a string only
Tyler Christopher G is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.