blocks|key|1215769|text|使用SecureString对象的全部原因是为了避免创建string对象(该对象被加载到内存中，并以明文形式保存在那里，直到进行垃圾回收)。但是，您可以通过附加字符将字符添加到SecureString。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1215770|var+s+=+new+SecureString();
s.AppendChar('d');
s.AppendChar('u');
s.AppendChar('m');
s.AppendChar('b');
s.AppendChar('p');
s.AppendChar('a');
s.AppendChar('s');
s.AppendChar('s');
s.AppendChar('w');
s.AppendChar('d');|code-block|syntax|javascript|1215771|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You don't. The whole reason for using the SecureString object is to avoid creating a string object (which is loaded into memory and kept there in plaintext until garbage collection). However, you can add characters to a SecureString by appending them.

<pre><code>var s = new SecureString();
s.AppendChar('d');
s.AppendChar('u');
s.AppendChar('m');
s.AppendChar('b');
s.AppendChar('p');
s.AppendChar('a');
s.AppendChar('s');
s.AppendChar('s');
s.AppendChar('w');
s.AppendChar('d');
</code></pre>

blocks|key|1430732|text|下面的方法有助于将字符串转换为安全字符串|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430733|private+SecureString+ConvertToSecureString(string+password)
{
++++if+(password+==+null)
++++++++throw+new+ArgumentNullException("password");

++++var+securePassword+=+new+SecureString();

++++foreach+(char+c+in+password)
++++++++securePassword.AppendChar(c);

++++securePassword.MakeReadOnly();
++++return+securePassword;
}|code-block|syntax|javascript|1430734|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

below method helps to convert string to secure string

<pre><code>private SecureString ConvertToSecureString(string password)
{
 if (password == null)
 throw new ArgumentNullException("password");

 var securePassword = new SecureString();

 foreach (char c in password)
 securePassword.AppendChar(c);

 securePassword.MakeReadOnly();
 return securePassword;
}
</code></pre>

blocks|key|1215910|text|您可以执行以下操作：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1215911|string+password+=+"test";
SecureString+sec_pass+=+new+SecureString();
Array.ForEach(password.ToArray(),+sec_pass.AppendChar);
sec_pass.MakeReadOnly();|code-block|syntax|javascript|1215912|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You can follow this:

<pre><code>string password = "test";
SecureString sec_pass = new SecureString();
Array.ForEach(password.ToArray(), sec_pass.AppendChar);
sec_pass.MakeReadOnly();
</code></pre>

blocks|key|1430825|text|这是一个廉价的linq技巧。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430826|++++++++++++SecureString+sec+=+new+SecureString();
++++++++++++string+pwd+=+"abc123";+/*+Not+Secure!+*/
++++++++++++pwd.ToCharArray().ToList().ForEach(sec.AppendChar);
++++++++++++/*+and+now+:+seal+the+deal+*/
++++++++++++sec.MakeReadOnly();|code-block|syntax|javascript|1430827|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Here is a cheap linq trick.

<pre><code> SecureString sec = new SecureString();
 string pwd = "abc123"; /* Not Secure! */
 pwd.ToCharArray().ToList().ForEach(sec.AppendChar);
 /* and now : seal the deal */
 sec.MakeReadOnly();
</code></pre>

blocks|key|1430601|text|我要把这个扔出去。为什么？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430602|你不能仅仅改变你所有的字符串来保护字符串，突然你的应用程序就变得“安全”了。Secure+string的设计目的是尽可能长时间地保持字符串加密，并且只在很短的时间内解密，在对其执行操作后擦除内存。|1430603|我敢说，在担心应用程序字符串的安全之前，您可能有一些设计级别的问题需要处理。给我们更多关于你尝试做什么的信息，我们可能会提供更好的帮助。|1430604|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

I'll throw this out there. Why?

You can't just change all your strings to secure strings and suddenly your application is "secure". Secure string is designed to keep the string encrypted for as long as possible, and only decrypted for a very short period of time, wiping the memory after an operation has been performed upon it.

I would hazard saying that you may have some design level issues to deal with before worrying about securing your application strings. Give us some more information on what your trying to do and we may be able to help better.

blocks|key|1215926|text|unsafe+
{
++++fixed(char*+psz+=+password)
++++++++return+new+SecureString(psz,+password.Length);
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1215927|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>unsafe 
{
 fixed(char* psz = password)
 return new SecureString(psz, password.Length);
}
</code></pre>

blocks|key|1430918|text|没有花哨的linq，没有手动添加所有的字符，只是简单明了：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430919|var+str+=+"foo";
var+sc+=+new+SecureString();
foreach(char+c+in+str)+sc.appendChar(c);|code-block|syntax|javascript|1430920|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

no fancy linq, not adding all the chars by hand, just plain and simple:

<pre><code>var str = "foo";
var sc = new SecureString();
foreach(char c in str) sc.appendChar(c);
</code></pre>

blocks|key|1430702|text|我同意Spence+(%2B1)，但如果你是为了学习或测试pourposes而这样做的，你可以在字符串中使用foreach，使用AppendChar方法将每个字符附加到securestring。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430703|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I'm agree with Spence (+1), but if you're doing it for learning or testing pourposes, you can use a foreach in the string, appending each char to the securestring using the AppendChar method.

blocks|key|1216016|text|如果您希望将从string到SecureString的转换压缩为LINQ语句，您可以将其表示为：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1216017|var+plain++=+"The+quick+brown+fox+jumps+over+the+lazy+dog";
var+secure+=+plain
+++++++++++++.ToCharArray()
+++++++++++++.Aggregate(+new+SecureString()
+++++++++++++++++++++++,+(s,+c)+=>+{+s.AppendChar(c);+return+s;+}
+++++++++++++++++++++++,+(s)++++=>+{+s.MakeReadOnly();+return+s;+}
+++++++++++++++++++++++);|code-block|syntax|javascript|1216018|但是，请记住，使用LINQ并不能提高此解决方案的安全性。它与任何从string到SecureString的转换都存在相同的缺陷。只要原始string仍在内存中，数据就容易受到攻击。|1216019|话虽如此，上面的语句可以提供的是保持SecureString的创建，它的初始化与数据，并最终锁定它，使其不被修改。|1216020|entityMap^0|7|6|E|C|W|4|0|0|9|4|X|6|14|C|1W|6|0|I|C|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]|$9|T|A|U|B|C]|$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]|$9|13|A|14|B|C]|$9|15|A|16|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|17|8|@$9|18|A|19|B|C]]|D|@]|E|$]]|$1|O|3|-4|5|6|7|1A|8|@]|D|@]|E|$]]]|P|$]]

If you would like to compress the conversion of a <code>string</code> to a <code>SecureString</code> into a <code>LINQ</code> statement you can express it as follows:

<pre><code>var plain = "The quick brown fox jumps over the lazy dog";
var secure = plain
 .ToCharArray()
 .Aggregate( new SecureString()
 , (s, c) =&gt; { s.AppendChar(c); return s; }
 , (s) =&gt; { s.MakeReadOnly(); return s; }
 );
</code></pre>

However, keep in mind that using <code>LINQ</code> does not improve the security of this solution. It suffers from the same flaw as any conversion from <code>string</code> to <code>SecureString</code>. As long as the original <code>string</code> remains in memory the data is vulnerable.

That being said, what the above statement can offer is keeping together the creation of the <code>SecureString</code>, its initialization with data and finally locking it from modification.

blocks|key|1431032|text|为了完整性，我添加了两个单元测试和方法，将字符数组和字符串转换为SecureString，然后再转换回来。您应该尝试完全避免字符串，只传入指向字符数组或字符数组本身的指针，就像我在这里提供的方法一样，因为字符串是不安全的，因为它们在托管内存中以纯文本形式保存数据相当不确定的时间，直到下一个GC运行或强制执行，最好尽快将字符数组放入SecureString中，并将其保存在那里，然后作为字符数组再次读取。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1431033|这些测试如下所示：|1431034|using+NUnit.Framework;
using+System;
using+SecureStringExtensions;
using+System.Security;

namespace+SecureStringExtensions.Test
{
++++[TestFixture]
++++public+class+SecureStringExtensionsTest
++++{
++++++++[Test]
++++++++[TestCase(new+char[]+{+'G',+'O',+'A',+'T',+'1',+'2',+'3'+})]
++++++++public+void+CopyCharArrayToSecureStringAndCopyBackToCharArrayReturnsExpected(char[]+inputChars)
++++++++{
++++++++++++SecureString+sec+=+inputChars.ToSecureString();
++++++++++++var+copiedFromSec+=+sec.FromSecureStringToCharArray();
++++++++++++CollectionAssert.AreEqual(copiedFromSec,+inputChars);++++++++++++++++
++++++++}

++++++++[Test]
++++++++[TestCase("GOAT456")]
++++++++public+void+CopyStringToSecureStringAndCopyBackToUnsafeStringReturnsExpected(string+inputString)
++++++++{
++++++++++++SecureString+sec+=+inputString.ToSecureString();
++++++++++++var+copiedFromSec+=+sec.FromSecureStringToUnsafeString();
++++++++++++Assert.AreEqual(copiedFromSec,+inputString);
++++++++}
++++}
}|code-block|syntax|javascript|1431035|下面是我们的扩展方法：|1431036|using+System;
using+System.Runtime.InteropServices;
using+System.Security;

namespace+SecureStringExtensions
{
++++public+static+class+SecureStringExtensions
++++{
++++++++public+static+SecureString+ToSecureString(this+string+str)
++++++++{
++++++++++++return+ToSecureString(str.ToCharArray());
++++++++}

++++++++public+static+SecureString+ToSecureString(this+char[]+str)
++++++++{
++++++++++++var+secureString+=+new+SecureString();
++++++++++++Array.ForEach(str,+secureString.AppendChar);
++++++++++++return+secureString;
++++++++}

++++++++///+<summary>
++++++++///+Creates+a+managed+character+array+from+the+secure+string+using+methods+in+System.Runetime.InteropServices
++++++++///+copying+data+into+a+BSTR+(unmanaged+binary+string)+and+then+into+a+managed+character+array+which+is+returned+from+this+method.
++++++++///+Data+in+the+unmanaged+memory+temporarily+used+are+freed+up+before+the+method+returns.
++++++++///+</summary>
++++++++///+<param+name="secureString"></param>
++++++++///+<returns></returns>
++++++++public+static+char[]+FromSecureStringToCharArray(this+SecureString+secureString)
++++++++{
++++++++++++char[]+bytes;
++++++++++++var+ptr+=+IntPtr.Zero;
++++++++++++try
++++++++++++{
++++++++++++++++//alloc+unmanaged+binary+string++(BSTR)+and+copy+contents+of+SecureString+into+this+BSTR
++++++++++++++++ptr+=+Marshal.SecureStringToBSTR(secureString);
++++++++++++++++bytes+=+new+char[secureString.Length];
++++++++++++++++//copy+to+managed+memory+char+array+from+unmanaged+memory+
++++++++++++++++Marshal.Copy(ptr,+bytes,+0,+secureString.Length);
++++++++++++}
++++++++++++finally
++++++++++++{
++++++++++++++++if+(ptr+!=+IntPtr.Zero)
++++++++++++++++{
++++++++++++++++++++//free+unmanaged+memory
++++++++++++++++++++Marshal.ZeroFreeBSTR(ptr);
++++++++++++++++}
++++++++++++}
++++++++++++return+bytes;
++++++++}

++++++++///+<summary>
++++++++///+Returns+an+unsafe+string+in+managed+memory+from+SecureString.+
++++++++///+The+use+of+this+method+is+not+recommended+-+use+instead+the+<see+cref="FromSecureStringToCharArray(SecureString)"/>+method
++++++++///+as+that+method+has+not+got+multiple+copies+of+data+in+managed+memory+like+this+method.
++++++++///+Data+in+unmanaged+memory+temporarily+used+are+freed+up+before+the+method+returns.
++++++++///+</summary>
++++++++///+<param+name="secureString"></param>
++++++++///+<returns></returns>
++++++++public+static+string+FromSecureStringToUnsafeString(this+SecureString+secureString)
++++++++{
++++++++++++if+(secureString+==+null)
++++++++++++{
++++++++++++++++throw+new+ArgumentNullException(nameof(secureString));
++++++++++++}
++++++++++++var+unmanagedString+=+IntPtr.Zero;
++++++++++++try
++++++++++++{
++++++++++++++++//copy+secure+string+into+unmanaged+memory
++++++++++++++++unmanagedString+=+Marshal.SecureStringToGlobalAllocUnicode(secureString);
++++++++++++++++//alloc+managed+string+and+copy+contents+of+unmanaged+string+data+into+it
++++++++++++++++return+Marshal.PtrToStringUni(unmanagedString);
++++++++++++}
++++++++++++finally
++++++++++++{
++++++++++++++++++++if+(unmanagedString+!=+IntPtr.Zero)
++++++++++++++++{
++++++++++++++++++++Marshal.FreeBSTR(unmanagedString);
++++++++++++++++}
++++++++++++}
++++++++}

++++}
}|1431037|在这里，我们使用System.Runtime.InteropServices中的方法临时分配BSTR+(二进制非托管字符串)，并确保释放临时使用的非托管内存。|1431038|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|S|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|T|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|U|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|V|8|@]|9|@]|A|$]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

For completeness, I added two unit tests and methods to convert from char array and string into SecureString and back again. You should try to avoid strings altogether and only pass in either a pointer to a char array or the char array itself as in the methods I provide here, as strings are unsafe since they keep data in plain text in managed memory for rather indeterministic amount of time until next GC is run or forced, it is better to put your character array as soon as possible into a SecureString and keep it there and read it back again as a character array also.
The tests look like this:
<pre><code>using NUnit.Framework;
using System;
using SecureStringExtensions;
using System.Security;

namespace SecureStringExtensions.Test
{
 [TestFixture]
 public class SecureStringExtensionsTest
 {
 [Test]
 [TestCase(new char[] { 'G', 'O', 'A', 'T', '1', '2', '3' })]
 public void CopyCharArrayToSecureStringAndCopyBackToCharArrayReturnsExpected(char[] inputChars)
 {
 SecureString sec = inputChars.ToSecureString();
 var copiedFromSec = sec.FromSecureStringToCharArray();
 CollectionAssert.AreEqual(copiedFromSec, inputChars); 
 }

 [Test]
 [TestCase(&quot;GOAT456&quot;)]
 public void CopyStringToSecureStringAndCopyBackToUnsafeStringReturnsExpected(string inputString)
 {
 SecureString sec = inputString.ToSecureString();
 var copiedFromSec = sec.FromSecureStringToUnsafeString();
 Assert.AreEqual(copiedFromSec, inputString);
 }
 }
}
</code></pre>
And we have our extension methods here:
<pre><code>using System;
using System.Runtime.InteropServices;
using System.Security;

namespace SecureStringExtensions
{
 public static class SecureStringExtensions
 {
 public static SecureString ToSecureString(this string str)
 {
 return ToSecureString(str.ToCharArray());
 }

 public static SecureString ToSecureString(this char[] str)
 {
 var secureString = new SecureString();
 Array.ForEach(str, secureString.AppendChar);
 return secureString;
 }

 /// &lt;summary&gt;
 /// Creates a managed character array from the secure string using methods in System.Runetime.InteropServices
 /// copying data into a BSTR (unmanaged binary string) and then into a managed character array which is returned from this method.
 /// Data in the unmanaged memory temporarily used are freed up before the method returns.
 /// &lt;/summary&gt;
 /// &lt;param name=&quot;secureString&quot;&gt;&lt;/param&gt;
 /// &lt;returns&gt;&lt;/returns&gt;
 public static char[] FromSecureStringToCharArray(this SecureString secureString)
 {
 char[] bytes;
 var ptr = IntPtr.Zero;
 try
 {
 //alloc unmanaged binary string (BSTR) and copy contents of SecureString into this BSTR
 ptr = Marshal.SecureStringToBSTR(secureString);
 bytes = new char[secureString.Length];
 //copy to managed memory char array from unmanaged memory 
 Marshal.Copy(ptr, bytes, 0, secureString.Length);
 }
 finally
 {
 if (ptr != IntPtr.Zero)
 {
 //free unmanaged memory
 Marshal.ZeroFreeBSTR(ptr);
 }
 }
 return bytes;
 }

 /// &lt;summary&gt;
 /// Returns an unsafe string in managed memory from SecureString. 
 /// The use of this method is not recommended - use instead the &lt;see cref=&quot;FromSecureStringToCharArray(SecureString)&quot;/&gt; method
 /// as that method has not got multiple copies of data in managed memory like this method.
 /// Data in unmanaged memory temporarily used are freed up before the method returns.
 /// &lt;/summary&gt;
 /// &lt;param name=&quot;secureString&quot;&gt;&lt;/param&gt;
 /// &lt;returns&gt;&lt;/returns&gt;
 public static string FromSecureStringToUnsafeString(this SecureString secureString)
 {
 if (secureString == null)
 {
 throw new ArgumentNullException(nameof(secureString));
 }
 var unmanagedString = IntPtr.Zero;
 try
 {
 //copy secure string into unmanaged memory
 unmanagedString = Marshal.SecureStringToGlobalAllocUnicode(secureString);
 //alloc managed string and copy contents of unmanaged string data into it
 return Marshal.PtrToStringUni(unmanagedString);
 }
 finally
 {
 if (unmanagedString != IntPtr.Zero)
 {
 Marshal.FreeBSTR(unmanagedString);
 }
 }
 }

 }
}
</code></pre>
Here, we use methods from System.Runtime.InteropServices to alloc BSTR (binary unmanaged string) temporarily and also make sure to free up temporary used unmanaged memory.

blocks|key|1430945|text|您可以使用这个简单的脚本|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430946|private+SecureString+SecureStringConverter(string+pass)
{
++++SecureString+ret+=+new+SecureString();

++++foreach+(char+chr+in+pass.ToCharArray())
++++++++ret.AppendChar(chr);

++++return+ret;
}|code-block|syntax|javascript|1430947|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

you can use this simple script

<pre><code>private SecureString SecureStringConverter(string pass)
{
 SecureString ret = new SecureString();

 foreach (char chr in pass.ToCharArray())
 ret.AppendChar(chr);

 return ret;
}
</code></pre>

How to convert <code>String</code> to <code>SecureString</code>?

问将字符串转换为SecureString
EN

回答 11

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问将字符串转换为SecureStringEN

回答 11

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问将字符串转换为SecureString
EN