I have found a tool that requires me to compile it with Visual Studio. I am not sure if I can do it without the risk of malicious software being installed during the compiling process. Is that possible? Or would only the resulting exe file be malicious?
-
That would depend if VS had a vulnerability that could be exploited when compiling.– schroeder ♦Commented May 13, 2022 at 16:23
-
Not even that, project files can execute arbitrary code, that's a feature not a bug.– Bruno RohéeCommented May 13, 2022 at 16:43
-
seems like it could overwrite a file that's already loaded on startup. I've seen a few compiler type exploits mentioned on this site I think. The bigger threat is when you run it though. Whenever you're dealing with other people's code (who you don't know) there's a possibility of infection. I've also seen an exploit that hides code from view. (It's a unicode character that switches from left-to-right to right-to-left... so if the IDE is vulnerable it won't show the code when reviewing.)– browsermatorCommented May 13, 2022 at 17:31
Add a comment
|
1 Answer
From compiling C# code manually with the compiler, it would take an exploit in the compiler to do more than produce object files and error messages... Not impossible, but not likely either.
However, if you use a Visual Studio project file, a Makefile or any other build tool, you should very carefully review it as they all can execute arbitrary commands, so infecting you with a virus or worse is relatively easy.
