Added ScriptEngine.DisableDynamicBinding as additional mitigation for GitHub Issue #400.

ClearScriptLib · ClearScriptLib · commit 29db0c14b9c0 · 2022-07-08T13:25:48.000-04:00
diff --git a/ClearScript/HostItem.InvokeMethod.cs b/ClearScript/HostItem.InvokeMethod.cs
@@ -117,26 +117,35 @@ private MethodBindResult BindMethod(string name, Type[] typeArgs, object[] args,
             }
             else
             {
-                result = BindMethodInternal(signature, AccessContext, bindFlags, Target, name, typeArgs, args, bindArgs);
-                if (!result.IsPreferredMethod(this, name))
+                var forceReflection = Engine.DisableDynamicBinding;
+
+                if (forceReflection)
+                {
+                    result = new MethodBindFailure(() => new MissingMemberException(MiscHelpers.FormatInvariant("The object has no method named '{0}' that matches the specified arguments", name)));
+                }
+                else
                 {
-                    if (result is MethodBindSuccess)
+                    result = BindMethodInternal(signature, AccessContext, bindFlags, Target, name, typeArgs, args, bindArgs);
+                    if (!result.IsPreferredMethod(this, name))
                     {
-                        result = new MethodBindFailure(() => new MissingMemberException(MiscHelpers.FormatInvariant("The object has no method named '{0}' that matches the specified arguments", name)));
-                    }
+                        if (result is MethodBindSuccess)
+                        {
+                            result = new MethodBindFailure(() => new MissingMemberException(MiscHelpers.FormatInvariant("The object has no method named '{0}' that matches the specified arguments", name)));
+                        }
 
-                    foreach (var altName in GetAltMethodNames(name, bindFlags))
-                    {
-                        var altResult = BindMethodInternal(null, AccessContext, bindFlags, Target, altName, typeArgs, args, bindArgs);
-                        if (altResult.IsUnblockedMethod(this))
+                        foreach (var altName in GetAltMethodNames(name, bindFlags))
                         {
-                            result = altResult;
-                            break;
+                            var altResult = BindMethodInternal(null, AccessContext, bindFlags, Target, altName, typeArgs, args, bindArgs);
+                            if (altResult.IsUnblockedMethod(this))
+                            {
+                                result = altResult;
+                                break;
+                            }
                         }
                     }
                 }
 
-                if ((result is MethodBindFailure) && Engine.UseReflectionBindFallback)
+                if ((result is MethodBindFailure) && (forceReflection || Engine.UseReflectionBindFallback))
                 {
                     var reflectionResult = BindMethodUsingReflection(bindFlags, Target, name, typeArgs, args);
                     if (reflectionResult is MethodBindSuccess)
diff --git a/ClearScript/ScriptEngine.cs b/ClearScript/ScriptEngine.cs
@@ -264,14 +264,32 @@ public bool DisableExtensionMethods
         /// </remarks>
         public bool DisableFloatNarrowing { get; set; }
 
+        /// <summary>
+        /// Enables or disables dynamic method binding.
+        /// </summary>
+        /// <remarks>
+        /// When this property is set to <c>true</c>, the script engine bypasses the default method
+        /// binding algorithm and uses reflection-based method binding instead. This approach
+        /// abandons support for generic methods and other features, but it avoids engaging the
+        /// dynamic infrastructure.
+        /// </remarks>
+        /// <seealso cref="UseReflectionBindFallback"/>
+        public bool DisableDynamicBinding { get; set; }
+
         /// <summary>
         /// Enables or disables the use of reflection-based method binding as a fallback.
         /// </summary>
         /// <remarks>
+        /// <para>
         /// When this property is set to <c>true</c>, the script engine attempts to use
         /// reflection-based method binding when the default method binding algorithm fails. This
         /// approach reduces type safety, but it may be useful for running legacy scripts that rely
         /// on the specific behavior of reflection-based method binding.
+        /// </para>
+        /// <para>
+        /// This property has no effect when <see cref="DisableDynamicBinding"/> is set to
+        /// <c>true</c>.
+        /// </para>
         /// </remarks>
         public bool UseReflectionBindFallback { get; set; }
 

Original file line number	Diff line number	Diff line change
`@@ -117,26 +117,35 @@ private MethodBindResult BindMethod(string name, Type[] typeArgs, object[] args,`
`117`	`117`	`}`
`118`	`118`	`else`
`119`	`119`	`{`
`120`		`- result = BindMethodInternal(signature, AccessContext, bindFlags, Target, name, typeArgs, args, bindArgs);`
`121`		`- if (!result.IsPreferredMethod(this, name))`
	`120`	`+ var forceReflection = Engine.DisableDynamicBinding;`
	`121`	`+`
	`122`	`+ if (forceReflection)`
	`123`	`+ {`
	`124`	`+ result = new MethodBindFailure(() => new MissingMemberException(MiscHelpers.FormatInvariant("The object has no method named '{0}' that matches the specified arguments", name)));`
	`125`	`+ }`
	`126`	`+ else`
`122`	`127`	`{`
`123`		`- if (result is MethodBindSuccess)`
	`128`	`+ result = BindMethodInternal(signature, AccessContext, bindFlags, Target, name, typeArgs, args, bindArgs);`
	`129`	`+ if (!result.IsPreferredMethod(this, name))`
`124`	`130`	`{`
`125`		`- result = new MethodBindFailure(() => new MissingMemberException(MiscHelpers.FormatInvariant("The object has no method named '{0}' that matches the specified arguments", name)));`
`126`		`- }`
	`131`	`+ if (result is MethodBindSuccess)`
	`132`	`+ {`
	`133`	`+ result = new MethodBindFailure(() => new MissingMemberException(MiscHelpers.FormatInvariant("The object has no method named '{0}' that matches the specified arguments", name)));`
	`134`	`+ }`
`127`	`135`
`128`		`- foreach (var altName in GetAltMethodNames(name, bindFlags))`
`129`		`- {`
`130`		`- var altResult = BindMethodInternal(null, AccessContext, bindFlags, Target, altName, typeArgs, args, bindArgs);`
`131`		`- if (altResult.IsUnblockedMethod(this))`
	`136`	`+ foreach (var altName in GetAltMethodNames(name, bindFlags))`
`132`	`137`	`{`
`133`		`- result = altResult;`
`134`		`- break;`
	`138`	`+ var altResult = BindMethodInternal(null, AccessContext, bindFlags, Target, altName, typeArgs, args, bindArgs);`
	`139`	`+ if (altResult.IsUnblockedMethod(this))`
	`140`	`+ {`
	`141`	`+ result = altResult;`
	`142`	`+ break;`
	`143`	`+ }`
`135`	`144`	`}`
`136`	`145`	`}`
`137`	`146`	`}`
`138`	`147`
`139`		`- if ((result is MethodBindFailure) && Engine.UseReflectionBindFallback)`
	`148`	`+ if ((result is MethodBindFailure) && (forceReflection \|\| Engine.UseReflectionBindFallback))`
`140`	`149`	`{`
`141`	`150`	`var reflectionResult = BindMethodUsingReflection(bindFlags, Target, name, typeArgs, args);`
`142`	`151`	`if (reflectionResult is MethodBindSuccess)`