How to restrict Prism 4 to download only special signed modules?

Question

I have a WPF Desktop application using Prism 4, in my bootloader I have the following code:

protected override IModuleCatalog CreateModuleCatalog() { var filepath = Assembly.GetExecutingAssembly().Location; var path = Path.GetDirectoryName(filepath); System.IO.Directory.SetCurrentDirectory(path); path = Path.Combine(path, "Modules"); var moduleCatalog = new DirectoryModuleCatalog() { ModulePath = path }; return moduleCatalog; } 

the above code tells the prism to load all the dll files from the path "[my app root] \ Modules" and check them to make sure that any class has implemented IModule. What I want to do is to restrict the loading process only to DLLs that were signed with a special sign key so that no developer will enter a module into my application. please advice if I follow the wrong path for such a problem.

Answer 1

You are on the right track, however you need to go a little further. DirectoryModuleCatalog is designed to load any types into the specified directory that implement the IModule interface, as you saw. If you want to restrict the modules that are loaded further (for example, to assemblies signed with a specific key), you need to create your own module directory (most likely obtained from DirectoryModuleCatalog) and override the Initialize method. Initialization is where the module directory inspects the directory and loads a collection of ModuleInfo objects that contain information about any modules in the directory. Overriding this method, you can check assemblies in the directory and load modules only from assemblies with the appropriate signature. In the Initialize method, you populate the Modules property with the ModInfos module of the modules contained in the actual assemblies.

Then, in the above code, instead of creating a new DirectoryModuleCatalog () directory, you will create your own module directory.

Please note that depending on how you verify the signature of the assembly, you can load the assembly into memory (even if you do not make any modules in the directory). If so, you can check the assemblies in a separate AppDomain, which can then be unloaded (so unload unsigned assemblies from memory).

Answer 2

I created this custom DirectoryModuleCatalog where you can specify the incluson / exclusion set.