Question

I have an abstract class which calls one of its abstract methods, as so:

public abstract class VirtualAsset : ISerializable
{
    public void GetObjectData(SerializationInfo info, StreamingContext context)
    {
        SerializeAsset(info);
    }

    public abstract void SerializeAsset(SerializationInfo info);
}

The problem is, due to the fact that I am trusting user input, it is highly possible that a malicious user (or a user who doesn’t know what they are doing) could try to pass in an instance of VirtualAsset, instead of a subclass that implements the needed abstract function… In fact, when I purposefully do this, the program crashes without error.

I’ve tried using a try-catch to no avail… What is the best way to handle this problem effectively? Do I have to check self.GetType() every time I call overridable methods?

Answer 1

The problem is, due to the fact that I am trusting user input, it is highly possible that a malicious user (or a user who doesn’t know what they are doing) could try to pass in an instance of VirtualAsset

No, it’s not possible. An abstract class cannot be instantiated, by definition. Nobody will ever be able to create an instance of VirtualAsset, and any derived class that doesn’t implement the abstract method will have to be abstract as well.