dotnet / dotnet/aspnetcore

Should RegistryXmlRepository close the regkey between reads?

Open
#58,224 5 comments 0 reactions 0 assignees View on GitHub
area-dataprotection
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

`RegistryXmlRepository` takes a `RegistryKey` as a parameter in its constructor ([code ref](https://github.com/dotnet/aspnetcore/blob/main/src/DataProtection/DataProtection/src/Repositories/RegistryXmlRepository.cs#L36)), but that key is never disposed. Furthermore, if you construct this class inside a using block (see example), the class could attempt to access a closed registry key.

### Expected Behavior

- Class should be disposable and dispose/close the key correctly.
- Possibly the class should reopen the key? Not sure.

### Steps To Reproduce

1. Setup a standard ASP.NET core web app
2. Enable data protection for the app, persisting the data to the registry
3. Ensure that the registry key is disposed in the setup method
4. Notice that, when the protection information is accessed, the code will fail with an exception

```csharp
using var registryKey = RegistryKey
.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64)
.OpenSubKey(some_registry_path, true);

dataProtectionBuilder.ProtectKeysWithDpapi(true).PersistKeysToRegistry(registryKey);
```

### Exceptions (if any)

```
"Type":"System.ObjectDisposedException",
"Message":"Cannot access a closed registry key."
"Object name: 'key path set in code'."
```

### .NET Version

8.0.400

### Anything else?

- Is the key even supposed to be closed/disposed?
- If not, maybe the documentation for these extension methods/classes just needs updating

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.