Can you pass a variable into the C# compiler code?

Question

Here's my current situation - I have an application that compiles C# code taken in as a string, using CodeDom. I have a SecureString that stores a password and I was wondering if there would be any way to pass that SecureString variable into the compiled code as a SecureString?

Here is some example code:

SecureString securePassword = getSecurePass();

string codeString =
        @"using System;
        using System.Security;

        namespace SomeProgram
        {
            class MyClass
            {
                static void Main(string[] args)
                {
                    SecureString securePass = new SecureString();
                    // somehow set this equal to the securePassword variable
                }
            }
        }";


// Compiler Code
CodeDomProvider codeProvider = CodeDomProvider.CreateProvider("CSharp");
string outFile = "output.exe"; 

System.CodeDom.Compiler.CompilerParameters parameters = new CompilerParameters();
parameters.GenerateExecutable = true;
parameters.OutputAssembly = outFile;
CompilerResults results = codeProvider.CompileAssemblyFromSource(parameters, codeString);

I can't find a way to do this and I imagine that this isn't actually possible and instead I should possibly just store the password in an encrypted file and read it from that?

Answer 1

I think you're confused about the concepts. You're trying to compile the password into an exe file, and you think that SecureString will keep your password secure. That's not what the SecureString is for. Read the documentation:

(SecureString) Represents text that should be kept confidential, such as by deleting it from computer memory when no longer needed.

SecureString will only protect your in-memory password by 1) encrypting it while it is in the memory so no other apps can sniff it, and 2) removing it from the memory once you're done with it.

If you compile your password into an exe, a hacker can easily get it from there even if it is encrypted. In fact, getting it from the exe is much easier than getting it from the memory. Encrypting it will only make it a bit harder, but a skilled hacker can still decrypt it after finding the key. The suggestion given by Gseg to compile it as an embedded resource and your suggestion of encrypting it in a text file, both will have the same issue.

It all comes down to the encryption key, where is it stored? If you store it in the exe file (because you need your app to be able to decrypt it), then the hacker will be able to find the key and use it to decrypt your password. You will need to store it outside the exe in a way that is not reachable by the hacker. So the real issue that you need to think about is: Where to store the encryption key so the app can read it, but the hacker cannot?.

Now, when your app retrieves the key, then now you can decrypt the password to a SecureString variable to protect it while it is in memory and remove it afterwards.