asp.net MVC : drop in dll plugin & more

[raddevus]

Background Recently I wanted to share some functionality between two MVC sites. I started analyzing how I might build one DLL that I could drop in each site. Code re-use, you know? What I Learned You can build a .NET Web API, compile it and drop it into any other ASP.NET MVC site's bin directory and run that code. You can extend a currently running MVC app very easily this way. That's Really Cool, And... ...a little scary. Steps To Reproduce It For Yourself 1. Create a .NET MVC Web API project in Visual Studio 2. Remove all existing controllers -- because if they clash it will crash the target MVC app. 3. Add a RandomNamed (obscurely named) controller to the web api so you won't have to worry about controller having a name clash. Here's my very simple example code.

namespace ExtensionAPI.Controllers
{
public class RandomNamedController : Controller
{
// GET: RandomNamed
public ActionResult Index()
{
return Content(String.Format("Your computer is named : {0}", Environment.MachineName));
}

    // GET: RandomNamed/Details/5
    public ActionResult DoStuff(int id=0)
    {
        switch (id)
        {
            case 1:
            {
                return Content(String.Format("No worries! I've deleted all your files."));
                break;
            }
        }
        return Content("I was lazy and didn't do anything. You've got to send an id to get me to do something.");
    }

4. Build the code. 5. Get the target DLL and copy it into the bin directory of our ASP.NET MVC app. The one that is innocently running. Dropping the DLL will force the app to restart and your dll will be loaded automatically. 6. make a call to your new URL http://<OriginalURL>/RandomNamed/ Yes, that's right. There is now a new route to your new Web API in your original MVC app. The app will respond with :

Your computer is named : RADDEVUS-Computer

I'm not sure you'd ever know that new DLL was there. This is very cool for extending the functionality of a web site. But seems a little dangerous. Of course they have to be able to get to your MVC bin directory which is running in prod so there are other ways to defend that. .NET CORE Very interesting...If you build an MVC .NET Core app, it will not load the extension dll. I have tried all manner o