blocks|key|1430601|text|我要把这个扔出去。为什么？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430602|你不能仅仅改变你所有的字符串来保护字符串，突然你的应用程序就变得“安全”了。Secure+string的设计目的是尽可能长时间地保持字符串加密，并且只在很短的时间内解密，在对其执行操作后擦除内存。|1430603|我敢说，在担心应用程序字符串的安全之前，您可能有一些设计级别的问题需要处理。给我们更多关于你尝试做什么的信息，我们可能会提供更好的帮助。|1430604|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

I'll throw this out there. Why?

You can't just change all your strings to secure strings and suddenly your application is "secure". Secure string is designed to keep the string encrypted for as long as possible, and only decrypted for a very short period of time, wiping the memory after an operation has been performed upon it.

I would hazard saying that you may have some design level issues to deal with before worrying about securing your application strings. Give us some more information on what your trying to do and we may be able to help better.

blocks|key|1215769|text|使用SecureString对象的全部原因是为了避免创建string对象(该对象被加载到内存中，并以明文形式保存在那里，直到进行垃圾回收)。但是，您可以通过附加字符将字符添加到SecureString。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1215770|var+s+=+new+SecureString();
s.AppendChar('d');
s.AppendChar('u');
s.AppendChar('m');
s.AppendChar('b');
s.AppendChar('p');
s.AppendChar('a');
s.AppendChar('s');
s.AppendChar('s');
s.AppendChar('w');
s.AppendChar('d');|code-block|syntax|javascript|1215771|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You don't. The whole reason for using the SecureString object is to avoid creating a string object (which is loaded into memory and kept there in plaintext until garbage collection). However, you can add characters to a SecureString by appending them.

<pre><code>var s = new SecureString();
s.AppendChar('d');
s.AppendChar('u');
s.AppendChar('m');
s.AppendChar('b');
s.AppendChar('p');
s.AppendChar('a');
s.AppendChar('s');
s.AppendChar('s');
s.AppendChar('w');
s.AppendChar('d');
</code></pre>

blocks|key|1430702|text|我同意Spence+(%2B1)，但如果你是为了学习或测试pourposes而这样做的，你可以在字符串中使用foreach，使用AppendChar方法将每个字符附加到securestring。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430703|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I'm agree with Spence (+1), but if you're doing it for learning or testing pourposes, you can use a foreach in the string, appending each char to the securestring using the AppendChar method.

blocks|key|1430732|text|下面的方法有助于将字符串转换为安全字符串|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430733|private+SecureString+ConvertToSecureString(string+password)
{
++++if+(password+==+null)
++++++++throw+new+ArgumentNullException("password");

++++var+securePassword+=+new+SecureString();

++++foreach+(char+c+in+password)
++++++++securePassword.AppendChar(c);

++++securePassword.MakeReadOnly();
++++return+securePassword;
}|code-block|syntax|javascript|1430734|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

below method helps to convert string to secure string

<pre><code>private SecureString ConvertToSecureString(string password)
{
 if (password == null)
 throw new ArgumentNullException("password");

 var securePassword = new SecureString();

 foreach (char c in password)
 securePassword.AppendChar(c);

 securePassword.MakeReadOnly();
 return securePassword;
}
</code></pre>

blocks|key|1215910|text|您可以执行以下操作：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1215911|string+password+=+"test";
SecureString+sec_pass+=+new+SecureString();
Array.ForEach(password.ToArray(),+sec_pass.AppendChar);
sec_pass.MakeReadOnly();|code-block|syntax|javascript|1215912|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You can follow this:

<pre><code>string password = "test";
SecureString sec_pass = new SecureString();
Array.ForEach(password.ToArray(), sec_pass.AppendChar);
sec_pass.MakeReadOnly();
</code></pre>

blocks|key|1215926|text|unsafe+
{
++++fixed(char*+psz+=+password)
++++++++return+new+SecureString(psz,+password.Length);
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1215927|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>unsafe 
{
 fixed(char* psz = password)
 return new SecureString(psz, password.Length);
}
</code></pre>

blocks|key|1430825|text|这是一个廉价的linq技巧。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430826|++++++++++++SecureString+sec+=+new+SecureString();
++++++++++++string+pwd+=+"abc123";+/*+Not+Secure!+*/
++++++++++++pwd.ToCharArray().ToList().ForEach(sec.AppendChar);
++++++++++++/*+and+now+:+seal+the+deal+*/
++++++++++++sec.MakeReadOnly();|code-block|syntax|javascript|1430827|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Here is a cheap linq trick.

<pre><code> SecureString sec = new SecureString();
 string pwd = "abc123"; /* Not Secure! */
 pwd.ToCharArray().ToList().ForEach(sec.AppendChar);
 /* and now : seal the deal */
 sec.MakeReadOnly();
</code></pre>

blocks|key|1216016|text|如果您希望将从string到SecureString的转换压缩为LINQ语句，您可以将其表示为：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1216017|var+plain++=+"The+quick+brown+fox+jumps+over+the+lazy+dog";
var+secure+=+plain
+++++++++++++.ToCharArray()
+++++++++++++.Aggregate(+new+SecureString()
+++++++++++++++++++++++,+(s,+c)+=>+{+s.AppendChar(c);+return+s;+}
+++++++++++++++++++++++,+(s)++++=>+{+s.MakeReadOnly();+return+s;+}
+++++++++++++++++++++++);|code-block|syntax|javascript|1216018|但是，请记住，使用LINQ并不能提高此解决方案的安全性。它与任何从string到SecureString的转换都存在相同的缺陷。只要原始string仍在内存中，数据就容易受到攻击。|1216019|话虽如此，上面的语句可以提供的是保持SecureString的创建，它的初始化与数据，并最终锁定它，使其不被修改。|1216020|entityMap^0|7|6|E|C|W|4|0|0|9|4|X|6|14|C|1W|6|0|I|C|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]|$9|T|A|U|B|C]|$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]|$9|13|A|14|B|C]|$9|15|A|16|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|17|8|@$9|18|A|19|B|C]]|D|@]|E|$]]|$1|O|3|-4|5|6|7|1A|8|@]|D|@]|E|$]]]|P|$]]

If you would like to compress the conversion of a <code>string</code> to a <code>SecureString</code> into a <code>LINQ</code> statement you can express it as follows:

<pre><code>var plain = "The quick brown fox jumps over the lazy dog";
var secure = plain
 .ToCharArray()
 .Aggregate( new SecureString()
 , (s, c) =&gt; { s.AppendChar(c); return s; }
 , (s) =&gt; { s.MakeReadOnly(); return s; }
 );
</code></pre>

However, keep in mind that using <code>LINQ</code> does not improve the security of this solution. It suffers from the same flaw as any conversion from <code>string</code> to <code>SecureString</code>. As long as the original <code>string</code> remains in memory the data is vulnerable.

That being said, what the above statement can offer is keeping together the creation of the <code>SecureString</code>, its initialization with data and finally locking it from modification.

blocks|key|1430918|text|没有花哨的linq，没有手动添加所有的字符，只是简单明了：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430919|var+str+=+"foo";
var+sc+=+new+SecureString();
foreach(char+c+in+str)+sc.appendChar(c);|code-block|syntax|javascript|1430920|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

no fancy linq, not adding all the chars by hand, just plain and simple:

<pre><code>var str = "foo";
var sc = new SecureString();
foreach(char c in str) sc.appendChar(c);
</code></pre>

blocks|key|1430945|text|您可以使用这个简单的脚本|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1430946|private+SecureString+SecureStringConverter(string+pass)
{
++++SecureString+ret+=+new+SecureString();

++++foreach+(char+chr+in+pass.ToCharArray())
++++++++ret.AppendChar(chr);

++++return+ret;
}|code-block|syntax|javascript|1430947|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

you can use this simple script

<pre><code>private SecureString SecureStringConverter(string pass)
{
 SecureString ret = new SecureString();

 foreach (char chr in pass.ToCharArray())
 ret.AppendChar(chr);

 return ret;
}
</code></pre>

blocks|key|1431032|text|为了完整性，我添加了两个单元测试和方法，将字符数组和字符串转换为SecureString，然后再转换回来。您应该尝试完全避免字符串，只传入指向字符数组或字符数组本身的指针，就像我在这里提供的方法一样，因为字符串是不安全的，因为它们在托管内存中以纯文本形式保存数据相当不确定的时间，直到下一个GC运行或强制执行，最好尽快将字符数组放入SecureString中，并将其保存在那里，然后作为字符数组再次读取。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1431033|这些测试如下所示：|1431034|using+NUnit.Framework;
using+System;
using+SecureStringExtensions;
using+System.Security;

namespace+SecureStringExtensions.Test
{
++++[TestFixture]
++++public+class+SecureStringExtensionsTest
++++{
++++++++[Test]
++++++++[TestCase(new+char[]+{+'G',+'O',+'A',+'T',+'1',+'2',+'3'+})]
++++++++public+void+CopyCharArrayToSecureStringAndCopyBackToCharArrayReturnsExpected(char[]+inputChars)
++++++++{
++++++++++++SecureString+sec+=+inputChars.ToSecureString();
++++++++++++var+copiedFromSec+=+sec.FromSecureStringToCharArray();
++++++++++++CollectionAssert.AreEqual(copiedFromSec,+inputChars);++++++++++++++++
++++++++}

++++++++[Test]
++++++++[TestCase("GOAT456")]
++++++++public+void+CopyStringToSecureStringAndCopyBackToUnsafeStringReturnsExpected(string+inputString)
++++++++{
++++++++++++SecureString+sec+=+inputString.ToSecureString();
++++++++++++var+copiedFromSec+=+sec.FromSecureStringToUnsafeString();
++++++++++++Assert.AreEqual(copiedFromSec,+inputString);
++++++++}
++++}
}|code-block|syntax|javascript|1431035|下面是我们的扩展方法：|1431036|using+System;
using+System.Runtime.InteropServices;
using+System.Security;

namespace+SecureStringExtensions
{
++++public+static+class+SecureStringExtensions
++++{
++++++++public+static+SecureString+ToSecureString(this+string+str)
++++++++{
++++++++++++return+ToSecureString(str.ToCharArray());
++++++++}

++++++++public+static+SecureString+ToSecureString(this+char[]+str)
++++++++{
++++++++++++var+secureString+=+new+SecureString();
++++++++++++Array.ForEach(str,+secureString.AppendChar);
++++++++++++return+secureString;
++++++++}

++++++++///+<summary>
++++++++///+Creates+a+managed+character+array+from+the+secure+string+using+methods+in+System.Runetime.InteropServices
++++++++///+copying+data+into+a+BSTR+(unmanaged+binary+string)+and+then+into+a+managed+character+array+which+is+returned+from+this+method.
++++++++///+Data+in+the+unmanaged+memory+temporarily+used+are+freed+up+before+the+method+returns.
++++++++///+</summary>
++++++++///+<param+name="secureString"></param>
++++++++///+<returns></returns>
++++++++public+static+char[]+FromSecureStringToCharArray(this+SecureString+secureString)
++++++++{
++++++++++++char[]+bytes;
++++++++++++var+ptr+=+IntPtr.Zero;
++++++++++++try
++++++++++++{
++++++++++++++++//alloc+unmanaged+binary+string++(BSTR)+and+copy+contents+of+SecureString+into+this+BSTR
++++++++++++++++ptr+=+Marshal.SecureStringToBSTR(secureString);
++++++++++++++++bytes+=+new+char[secureString.Length];
++++++++++++++++//copy+to+managed+memory+char+array+from+unmanaged+memory+
++++++++++++++++Marshal.Copy(ptr,+bytes,+0,+secureString.Length);
++++++++++++}
++++++++++++finally
++++++++++++{
++++++++++++++++if+(ptr+!=+IntPtr.Zero)
++++++++++++++++{
++++++++++++++++++++//free+unmanaged+memory
++++++++++++++++++++Marshal.ZeroFreeBSTR(ptr);
++++++++++++++++}
++++++++++++}
++++++++++++return+bytes;
++++++++}

++++++++///+<summary>
++++++++///+Returns+an+unsafe+string+in+managed+memory+from+SecureString.+
++++++++///+The+use+of+this+method+is+not+recommended+-+use+instead+the+<see+cref="FromSecureStringToCharArray(SecureString)"/>+method
++++++++///+as+that+method+has+not+got+multiple+copies+of+data+in+managed+memory+like+this+method.
++++++++///+Data+in+unmanaged+memory+temporarily+used+are+freed+up+before+the+method+returns.
++++++++///+</summary>
++++++++///+<param+name="secureString"></param>
++++++++///+<returns></returns>
++++++++public+static+string+FromSecureStringToUnsafeString(this+SecureString+secureString)
++++++++{
++++++++++++if+(secureString+==+null)
++++++++++++{
++++++++++++++++throw+new+ArgumentNullException(nameof(secureString));
++++++++++++}
++++++++++++var+unmanagedString+=+IntPtr.Zero;
++++++++++++try
++++++++++++{
++++++++++++++++//copy+secure+string+into+unmanaged+memory
++++++++++++++++unmanagedString+=+Marshal.SecureStringToGlobalAllocUnicode(secureString);
++++++++++++++++//alloc+managed+string+and+copy+contents+of+unmanaged+string+data+into+it
++++++++++++++++return+Marshal.PtrToStringUni(unmanagedString);
++++++++++++}
++++++++++++finally
++++++++++++{
++++++++++++++++++++if+(unmanagedString+!=+IntPtr.Zero)
++++++++++++++++{
++++++++++++++++++++Marshal.FreeBSTR(unmanagedString);
++++++++++++++++}
++++++++++++}
++++++++}

++++}
}|1431037|在这里，我们使用System.Runtime.InteropServices中的方法临时分配BSTR+(二进制非托管字符串)，并确保释放临时使用的非托管内存。|1431038|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|S|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|T|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|U|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|V|8|@]|9|@]|A|$]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

For completeness, I added two unit tests and methods to convert from char array and string into SecureString and back again. You should try to avoid strings altogether and only pass in either a pointer to a char array or the char array itself as in the methods I provide here, as strings are unsafe since they keep data in plain text in managed memory for rather indeterministic amount of time until next GC is run or forced, it is better to put your character array as soon as possible into a SecureString and keep it there and read it back again as a character array also.
The tests look like this:
<pre><code>using NUnit.Framework;
using System;
using SecureStringExtensions;
using System.Security;

namespace SecureStringExtensions.Test
{
 [TestFixture]
 public class SecureStringExtensionsTest
 {
 [Test]
 [TestCase(new char[] { 'G', 'O', 'A', 'T', '1', '2', '3' })]
 public void CopyCharArrayToSecureStringAndCopyBackToCharArrayReturnsExpected(char[] inputChars)
 {
 SecureString sec = inputChars.ToSecureString();
 var copiedFromSec = sec.FromSecureStringToCharArray();
 CollectionAssert.AreEqual(copiedFromSec, inputChars); 
 }

 [Test]
 [TestCase(&quot;GOAT456&quot;)]
 public void CopyStringToSecureStringAndCopyBackToUnsafeStringReturnsExpected(string inputString)
 {
 SecureString sec = inputString.ToSecureString();
 var copiedFromSec = sec.FromSecureStringToUnsafeString();
 Assert.AreEqual(copiedFromSec, inputString);
 }
 }
}
</code></pre>
And we have our extension methods here:
<pre><code>using System;
using System.Runtime.InteropServices;
using System.Security;

namespace SecureStringExtensions
{
 public static class SecureStringExtensions
 {
 public static SecureString ToSecureString(this string str)
 {
 return ToSecureString(str.ToCharArray());
 }

 public static SecureString ToSecureString(this char[] str)
 {
 var secureString = new SecureString();
 Array.ForEach(str, secureString.AppendChar);
 return secureString;
 }

 /// &lt;summary&gt;
 /// Creates a managed character array from the secure string using methods in System.Runetime.InteropServices
 /// copying data into a BSTR (unmanaged binary string) and then into a managed character array which is returned from this method.
 /// Data in the unmanaged memory temporarily used are freed up before the method returns.
 /// &lt;/summary&gt;
 /// &lt;param name=&quot;secureString&quot;&gt;&lt;/param&gt;
 /// &lt;returns&gt;&lt;/returns&gt;
 public static char[] FromSecureStringToCharArray(this SecureString secureString)
 {
 char[] bytes;
 var ptr = IntPtr.Zero;
 try
 {
 //alloc unmanaged binary string (BSTR) and copy contents of SecureString into this BSTR
 ptr = Marshal.SecureStringToBSTR(secureString);
 bytes = new char[secureString.Length];
 //copy to managed memory char array from unmanaged memory 
 Marshal.Copy(ptr, bytes, 0, secureString.Length);
 }
 finally
 {
 if (ptr != IntPtr.Zero)
 {
 //free unmanaged memory
 Marshal.ZeroFreeBSTR(ptr);
 }
 }
 return bytes;
 }

 /// &lt;summary&gt;
 /// Returns an unsafe string in managed memory from SecureString. 
 /// The use of this method is not recommended - use instead the &lt;see cref=&quot;FromSecureStringToCharArray(SecureString)&quot;/&gt; method
 /// as that method has not got multiple copies of data in managed memory like this method.
 /// Data in unmanaged memory temporarily used are freed up before the method returns.
 /// &lt;/summary&gt;
 /// &lt;param name=&quot;secureString&quot;&gt;&lt;/param&gt;
 /// &lt;returns&gt;&lt;/returns&gt;
 public static string FromSecureStringToUnsafeString(this SecureString secureString)
 {
 if (secureString == null)
 {
 throw new ArgumentNullException(nameof(secureString));
 }
 var unmanagedString = IntPtr.Zero;
 try
 {
 //copy secure string into unmanaged memory
 unmanagedString = Marshal.SecureStringToGlobalAllocUnicode(secureString);
 //alloc managed string and copy contents of unmanaged string data into it
 return Marshal.PtrToStringUni(unmanagedString);
 }
 finally
 {
 if (unmanagedString != IntPtr.Zero)
 {
 Marshal.FreeBSTR(unmanagedString);
 }
 }
 }

 }
}
</code></pre>
Here, we use methods from System.Runtime.InteropServices to alloc BSTR (binary unmanaged string) temporarily and also make sure to free up temporary used unmanaged memory.

How to convert <code>String</code> to <code>SecureString</code>?

Convert String to SecureString

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

问将字符串转换为SecureString
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问将字符串转换为SecureStringEN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问将字符串转换为SecureString
EN