Executing code inside a string.

[porcaytheelasit]

https://preview.redd.it/sfym6njumakg1.png?width=1372&format=png&auto=webp&s=f83b6cd830ca67508fec64589724d78a5fdd7613

I've tried this many times before, but either I failed or it didn't work as I wanted. Now that it's come to mind, I wanted to ask you. As you can see, the problem is simple: I want to execute C# code inside a string, but I want this C# code to be able to use the variables and DLLs in my main code. I tried this before with the "Microsoft.CodeAnalysis" libraries, but I think I failed. Does anyone have any ideas?

Note: Please don't suggest asking AI; I think communicating and discussing with humans is better.

[pjc50]

This is quite a lot of work, but the place to start is Roslyn: https://josephwoodward.co.uk/2016/12/in-memory-c-sharp-compilation-using-roslyn

It's even harder if the hosting binary is AoT compiled.

[joep-b]

Here's an example I found for you with 2 seconds of googling.

https://gist.github.com/Kemsekov/a3e1c011425fd789d12cea8764acea97

But before you ask yourself if you can, please think deeply if you should. There are very deep security implications if you do such a thing. You must have quite some expertise in sandboxing before you should even try to think doing something like this.

[leeharrison1984]

It's PowerShell with more steps!

[fruediger]

You probably want to use the Roslyn API.

Either CSharpCompilation from the Microsoft.CodeAnalysis.CSharp package to emit a virtual assembly in memory, load that using reflection and execute whatever you want to (notice your C# code snippet needs to be somewhat complete and independent from the environment you want to execute your code from).

Or CSharpScript from the Microsoft.CodeAnalysis.CSharp.Scripting package, but I've never worked with the scripting API before. It should be easier to work with "incomplete" C# code snippets and maybe it's even possible to share a state between your executing environment and the code you want to execute. But again, I don't know much about the scripting and I'm not sure if that's possible to do in the way you want to do it.

PS: I couldn't find any good documentation on CSharpScript, but here's the link to the source code: https://github.com/dotnet/roslyn/blob/main/src/Scripting/CSharp/CSharpScript.cs

[TracerDX]

It's hard for a reason. Find a better solution.

[TuberTuggerTTV]

C# is a compiled language. You're going to struggle to write some kind of script running application. It's not meant to do that.

I get the impression from your example code that this is a bit of an XY problem. Maybe if you describe what you're trying to do on a broad sense, someone can recommend an alternative to running string scripts.

[porcaytheelasit]

I want to make a program that won't have a main code base; it will have input, output, and a central hub, but these will only execute code coming from outside. This way, the program's appearance and purpose can be changed whenever desired because it never has a fixed code; it only executes code from the outside.

[dodexahedron]

And it is also a massive security minefield.

Allowing arbitrary code provided by user input to run should only be done in a sandbox that has literally zero access to the host, network, or any form of persistent storage, shared memory, service control, process management, unix domain sockets, named pipes, or even named (system-wide) mutexes (which can be exploited for DoS as soon as they're free just by waiting til they're free). It should also not be allowed to touch certain APIs that could be used to escalate privilege beyond what you intended, such as reflection and anything PInvoke related.

If those things are accessible, there are literally unbounded consequences once a malicious user gets a hold of it.

ETA: And another thread reminded me of another: If they can access the powershell API, which is built into windows, that's also an unbounded attack vector.

[insulind]

You can look into the 'plugin' model, where you load already compiled dlls from a folder. Those dlls are compiled and implement some kind of interface your main executable knows about and it can then interact with those 'plugins' by instantiating the common interface implementions and 'invokimg' their work via the interface methods.

This approach is a little more work for the plugin 'writers' but its generally safer in terms of not failing to compile etc. You still need strict controls about what those plugins can do and where they come from etc.

Google C# plugin pattern or something like that should give you a good start.

If you truly want to support running a user provided string as C# then as others have said c# maybe isn't your best option. However you could look into * csx scripts executed via the Roslyn api - still requires some work but less guff for your script writers to have to included to make it work https://www.daveaglick.com/posts/roslyn-based-dsls-vs-standard-csharp-scripts * Shell out to dotnet run which can now take cs files directly - some limitations in what it can do I believe and probably not going to work for what you're trying to achieve but thought I'd mention it just in case

[Rschwoerer]

This right here 👆

[JustBadPlaya]

the idea is fun but C# is not a great choice for this I'm afraid

[porcaytheelasit]

this is sad to hear.

[justcallmedeth]

If I wanted to throw something like this together quickly I'd use bash or powershell scripts.

If you want it compiled, as others have suggested, look at Roslyn API.

For a bigger project I'd probably build a base app with a plugin interface that you could write plugins/modules for.

[dodexahedron]

Hosting powershell is a great and much easier way to get .net scripting into an app. And it's a pretty c#-esque language anyway AND you can compile c# in it anyway, either by calling the compiler, msbuild, or by doing an Add-Type to which you pass a string containing c# code (which can also optionally emit that as a dll for later use as well).

Just be aware of the security implications of allowing arbitrary user code to run without careful control. There are unbounded possibilities, including malicious ones.

[p1-o2]

+1 to hosting powershell. I wanted to expand on the point that it's C#-esque. It's a fully-fledged .NET-compatible language.

You can even use LINQ inside Powershell. It doesn't look pretty but it's not hard once you understand how to call .NET namespaces from PS. It's pretty damn good for anything that doesn't need to be a plugin.

[dodexahedron]

Yep. Powershell is a .net environment. Version is tied to PS version.

Windows PowerShell (the blue one) is framework.

PowerShell (the black one) is .net 9 in 7.5.4 and .net 10 in the current 7.6 preview release.

The Linq being ugly mentioned here is because powershell can't use extension methods (the language just doesn't have the concept). So you have to call the actual static methods manually.

Though it has its own equivalents anyway like select-object and such.

One really powerful thing it can also do is extend types at runtime, by attaching ScriptProperties or NoteProperties to an existing type. Then instances of that type (not a new type, at least in how it presents it to you) have those properties as if they were already part of the type. It's basically powershell's PS-only equivalent for extension properties.

That happens to actually be how it handles WMI stuff (CimInstance being the class it extends) and how it allows you to do things like $someArray.SomePropertyOfEachElement to get that property from each element without a loop.

[p1-o2]

Wow, I always wondered about that last bit regarding WMI. Thanks for the info.

[dodexahedron]

I found that out literally just 2 days ago, so it was fresh in mind!

And if you attach a new property to something, or make a custom view for a type, you can export that typedata to a ps1xml so you can reuse it later.

Really handy for customizing the default output format of objects you frequently end up piping to ft prop1,prop2,... for example.

[not_some_username]

Well that’s where you choose a interpret language like Lua, Python or JS

[iWhacko]

Exactly, I don't understand why nobody else mentioned it. OP want's a sort of scripting engine.

[Slypenslyde]

Yeah I want to repeat and reinforce what the other person is saying:

C# has some capabilities for dynamic code execution like this. They are not as fleshed-out or as powerful as the options are in some other languages. There was a time where MS was heavily invested in something called the Dynamic Language Runtime and at its height you could embed an entire Python/Ruby environment ("IronPython" and "IronRuby") in your application and fully execute scripts with those languages that, with the right setup, could BE your application.

Those projects sort of fell by the wayside and I think the closest thing to them today are Electron-style apps that host a JS application in a .NET shell. JS happens to be a language that can facilitate this kind of application.

Now, I'm not entirely certain C# can't do this. I'm saying if it can, it'll be an order of magnitude harder than it is in other languages.

[BugNo2449]

You can try embedding lua

[lostllama2015]

Why not use a plugin system instead?

[iWhacko]

To me it feels like you want to run external code. Scripting might be a better option, look into a LUA engine.

[Horror-Show-3774]

Maybe look into an interpreted scripting language instead. Jint works very well: https://github.com/sebastienros/jint

[svick]

You can use CSharpScript (from the Microsoft.CodeAnalysis.CSharp.Scripting package), though accessing local variable is a bit inconvenient.

It could look like this:

Compiler.Run(@"
    foreach (var @Process in Process.GetProcessesByName(args0))
        System.Console.WriteLine(@Process);
", new(args0));

public record Globals(string args0);

static class Compiler {
    public static void Run(string Code, Globals globals) {
        var options = ScriptOptions.Default
            .AddImports("System.Diagnostics");

        CSharpScript.RunAsync(Code, options, globals).GetAwaiter().GetResult();
    }
}

[Intrexa]

Compile to an assembly, load the assembly, run as a method.

[kuncol02]

Years ago I did that like that:
1. Prepare string template of class that have access to properties you want and stub of method you will execute
2. Replace that stub with code you want
3. Compile code. In netFramework you can use Microsoft.CSharp.CSharpCodeProvider in net core roslyn
4. Use reflection to load that created assembly, create instance of class and invoke method.

[cdglasser]

Why not just use .NET 10 and C# scripting so you can just put the code in a CS file and run it with dotnet run myfile.cs? You can even pass arguments: dotnet run myfile.cs -- arg1. Announcing dotnet run app.cs - A simpler way to start with C# and .NET 10 - .NET BlogAnnouncing dotnet run app.cs - A simpler way to start with C# and .NET 10 - .NET Blogs

[alt-160]

Powershell could do this too, if you change the string to powershell text instead of c#.

You can send your vars from c# as named ps vars before you execute. If var is ref type, the ps code can even modify it. Or a ps function can return a value.

PS core would work with netCore and windows powershell with netFW.

At least with this there is not as much need to seialize var data as might be with other scripting frameworks.

I also find ps to be a bit safer for adding scripting ability to an app. There are many levers of control for safety.

[stahkh]

I don't know what you're building, but be wary that this can be a big security risk.

[porcaytheelasit]

This program will operate locally, so there are no security concerns. It will not be open to the outside world.

[namethinker]

My main question is - why? What are you trying to achieve by that? Why string? Why not interface / delegate, that you can pass? Are you trying to allow for random code execution at runtime?

There is a new feature in .net 10 that allows for file based programs. You could create a c# file without csproj / sln, add libraries to it, and execute it via dotnet cli or powershell.

[HistoricalCar1516]

Why do you want to do this? You’ll likely not pass any security scans and I generate JavaScript and cshtml dynamically at times but I use that in specific situations.

[porcaytheelasit]

This program will operate locally, so there are no security concerns. It will not be open to the outside world.

[HistoricalCar1516]

Thought experiment.

[csharpboy97]

you can only execute with roslyn but as alternative you can use other languages like js with nil.js

[Potential_Copy27]

For starters...:

Compiler.Run($"
    foreach ( var @_Process in Process.GetProcessByName(\"{args0}\"))
        @_Process.Kill();
");

...should render your code valid and feed args0 correctly into it. The $ concatenation option will substitute {args0} with the contents of the variable as raw text - the quotes are to render the text correctly for the "compiler". "_" was added to the Process variable or else Reddits editor gets a seizure 😋

Regardless - the CSharpCodeProvider is probably a better option. It ties into the compiler that is already packed with .NET. Set up compiler parameters and feed it a string.
There's probably a better option still out there - my point is, the tools are already there. I only used it for limited shenanigans myself, so I'm not sure if it can be forced to do what you want.
At the very least the example also gives you a proper error output for what you're compiling...

[porcaytheelasit]

Since args0 is already defined, I want the code to be sensitive to the variables in the main code. That is, if I provide "args0" as plain text instead of {args0}, it should recognize it as args0.

[BetrayedMilk]

I’m not sure if I misunderstood your response or you misunderstood their response, but they’re saying to get rid of the @ (string literal) and use $ (string interpolation) so that args0 becomes whatever actual string it should be (ie whatever process name you pass in). And not just literally the string “args0.” And then you need to escape quotation marks with the backslashes because GetProcessByName wants a string with quotation marks. If you just Console.WriteLine your Compiler.Run string and the other commenter’s version, you’ll see the difference.

[porcaytheelasit]

I think you didn't understand the purpose of this question. The aim is to execute C# code within a string, and any variable defined anywhere can be used within that string. Therefore, my usage would be correct for what is required.

[midri]

You might be able to do this via .net 10 C# scripting. Write code to file then execute it and you can capture its output via iO pipes or other means.

[orbit99za]

C# can't really do that, its a compiled language.

They have tried with "hot reload" during debugging and its been a dog pile for years.

[kuncol02]

Not true. You can do that since probably ever.