.net - How to prevent untrusted string parameter in C# -

for security reasons, don't want specific method receive non-programmer or non-compiler time strings, how this?

readonly string ok_str = "some text"; string bad_str = "another text";  public void setsecurestr(string str) {     //use string security purpose }  //somewhere in code setsecurestr(ok_str); //accepted setsecurestr(ok_str + "programmer passed staticlly!"); //accepted (if not possible implement, forget it) setsecurestr(bad_str); //throw exception, bad_str modifiable setsecurestr(ok_str + untrustedvar); //throw exception, concatenation modifiable setsecurestr(string.format("{0}", ok_str)); //throw exception, not const 

it may better whitelist against things inside ability control, such enums or local constants (or local whitelist configuration data if list isn't fixed ahead of time).

as rough check, check whether interned, since literals interned automatically via ldstr; note can explicitly intern too, isn't 100% safe.

and of course, in event question as asked, if string happens somewhere else literal (unconnected code) still trusted. suggest whitelist safer...

a whitelist simple as:

private static readonly hashset<string> whitelist = new hashset<string> {     "good", "more good" }; ... check via whitelist.contains(s) 

but note still mutable @ runtime (via reflection if necessary).