How to use unsafe code in safe contex?

Question

I need to use SecureString for a Microsoft's class and i found the following code on the internet:

public static class SecureStringExt
{
    public static SecureString ConvertToSecureString(this string password)
    {
        if (password == null)
            throw new ArgumentNullException("password");

        unsafe //Red highlighted line
        {
            fixed (char* passwordChars = password)
            {
                var securePassword = new SecureString(passwordChars, password.Length);
                securePassword.MakeReadOnly();
                return securePassword;
            }
        }
    }
}

The only problem is that the unsafe keyword keeps throwing me error saying Cannot use unsafe construct in safe context. Unfortunately i couldn't find why is this happening...

Note: The above code runs in LINQPad but not in VS2013 (with resharper).

I don't understand why you need to use unsafe here, you create secure string without unsafe code. Check my answer. — mybirthname, Sep 20 '14 at 22:33
The documentation says you shouldn't use that constructor. See http://msdn.microsoft.com/en-us/library/176bafkd(v=vs.110).aspx Use the code @mybirthname gave in his answer — MicroVirus, Sep 20 '14 at 22:39

AlexD · Accepted Answer · 2016-01-30T21:40:25.217

70

I am not sure if you need unsafe code in that case (see answer of @mybirthname).

But when unsafe code is needed, it can be enabled in Project properties.

In the main menu, click Project and then <ProjectName> properties...
Click on the Build page.
Select Allow unsafe code.

Or one can specify /unsafe compiler option explicitly.

edited Jan 30 '16 at 21:40

answered Sep 20 '14 at 22:28

AlexD

32,156
3
71
65

Can that be declared? – jww Sep 20 '14 at 22:32
@jww What do you mean? – AlexD Sep 20 '14 at 22:37
By using attributes. Something like [Declarative Security](http://msdn.microsoft.com/en-us/library/kaacwy28%28v=vs.110%29.aspx). It seems better to turn it off on an as-needed basis, rather than turning it off everywhere. – jww Sep 20 '14 at 23:31
1

@jww I completely agree that enabling unsafe compilation should be minimized. However I doubt that attributes will help with `unsafe {...}`. Compiler gives `error CS0227: Unsafe code may only appear if compiling with /unsafe`. If you have an idea how to do it, let me know please. – AlexD Sep 21 '14 at 00:50
that's what I was asking :) – jww Sep 21 '14 at 00:52

score 11 · Answer 2 · answered Sep 20 '14 at 22:33

    public static SecureString GetSecureString(string password)
    {
        SecureString secureString = new SecureString();

        foreach (char c in password)
        {
            secureString.AppendChar(c);
        }

        secureString.MakeReadOnly();
        return secureString;
    }

You can make same thing without unsafe code.

How to use unsafe code in safe contex?

2 Answers2