1

I have found a tool that requires me to compile it with Visual Studio. I am not sure if I can do it without the risk of malicious software being installed during the compiling process. Is that possible? Or would only the resulting exe file be malicious?

New contributor
kol99d is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
3
  • That would depend if VS had a vulnerability that could be exploited when compiling.
    – schroeder
    May 13 at 16:23
  • Not even that, project files can execute arbitrary code, that's a feature not a bug. May 13 at 16:43
  • seems like it could overwrite a file that's already loaded on startup. I've seen a few compiler type exploits mentioned on this site I think. The bigger threat is when you run it though. Whenever you're dealing with other people's code (who you don't know) there's a possibility of infection. I've also seen an exploit that hides code from view. (It's a unicode character that switches from left-to-right to right-to-left... so if the IDE is vulnerable it won't show the code when reviewing.)
    – pcalkins
    May 13 at 17:31

1 Answer 1

3

From compiling C# code manually with the compiler, it would take an exploit in the compiler to do more than produce object files and error messages... Not impossible, but not likely either.

However, if you use a Visual Studio project file, a Makefile or any other build tool, you should very carefully review it as they all can execute arbitrary commands, so infecting you with a virus or worse is relatively easy.

Your Answer

kol99d is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.