CS.CTOR.VIRTUAL

构造函数调用其类中定义的虚拟方法

漏洞与风险

调用虚拟方法时，到运行时间前，不会选择执行该方法的实际类型。构造函数调用虚拟方法时，调用该方法的实例的构造函数可能尚未执行。

外部指导

CWE-398：代码质量不佳的指示器

示例 1

复制

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
  namespace NameSpace {
      class BadlyConstructedType {
          public BadlyConstructedType() {
              DoBusiness();         // defect - call to a virtual method
          }
          public virtual void DoBusiness() {
              // doing business...
          }
      }
 
     public class DerivedType : BadlyConstructedType {
         public DerivedType () {}
         public override void DoBusiness() {
             // this method is may be called when the corresponding object is not constructed...
         }
     }
 }