Search code examples
c#securityconditional-compilationpreprocessor-directiveconditional-attribute

Do pre-processor directives protect server code from the client?


I'm developing a client-server library. Some of the classes can be used by either the client or the server but are executed differently and yield slightly different results for each. As well, the server code may contain additional methods that will not be called from the client build.

A class may look like this:

public class StuffDoer {

    public void DoStuff(object msg)
    {
        ServerDoStuff(msg);
        ClientDoStuff(msg);
    }

    [Conditional("SERVER")]
    private void ServerDoStuff(object msg) 
    {
        // Do secret server stuff...
    }

    [Conditional("CLIENT")]
    private void ClientDoStuff(object msg)
    {
        // Do client sutff...
    }

    [Conditional("SERVER")]
    public void DoCoolStuff(object msg)
    {
        // server does cool stuff...
    }

}

I've read that the Conditional attribute still compiles the code and would therefore be in the build, unlike pre-processor directives which would completely remove the code and not even compile it.

I'm concerned that a dishonest client may hack the product by unobfuscating the source code and figure out how the server works.

Are my fears unfounded or would I need to place pre-processor directives in order to hide the source code?


Solution

  • When "SERVER" is not defined, The method be marked as "SERVER" will always compile to the final assembly but all of callings to the method will be removed.

    This is code

    This is decompiled result