VBA Rubberducking

ThunderFrame

00:00

The reason I tried, is because Left is an identifier, and Wayne says there are internal versions of some functions. I assumed that using an internal function would result in it being highlighted as a keyword, but Left doesn't get highlighted as I expected... So, I tried using it as a statement. It compiles, but doesn't run.

Duga

RELOAD!

[FreezePhoenix/XtraUtils] 11 commits. 26872 additions. 143569 deletions.

[rubberduck-vba/Rubberduck] 3 opened issues. 2 closed issues. 12 issue comments.

[rubberduck-vba/RubberduckWeb] 2 commits. 207 additions. 103 deletions.

ThunderFrame

So, I'm guessing that the VBE's syntax highlighter chooses not to highlight all of the internal functions.

eg. Array is internal, but doesn't get highlighted.

Mathieu Guindon

00:56

@ThunderFrame because it's LHS and it would only be legal if it returned an object with a default member to assign to ;-)

@this yeah that

IvenBach

01:23

Errors make a lot more sense when you understand the underlying abstractions they are built on.

ThunderFrame

02:28

@MathieuGuindon yeah - only tried LHS in an effort to get syntax highlighting. So, either VBE only chooses to syntax highlight specific function identifiers (most likely), or Left isn't a built-in function - despite there being an identifier for it (Least likely).

ThunderFrame

02:52

@IvenBach Errors are a lot more common when you don't understand the underlying abstractions they are built on.

IvenBach

Right you are.

Duga

03:53

[rubberduck-vba/Rubberduck] Stevefb opened issue #4173: Auto-correct for common tpyos...

> Loving the new auto correct feature - hats off.

Sometimes I accidentally type: `If true them` when I really mean: `If true then`. Anyway, I just _thought_ I had one of those moments and _thought_ I saw Rubberduck auto-magically change *them* to *Then* when I pressed enter.

But Rubberduck didn't change anything so apparently I didn't make a typo (screen flicker?) but, all the same I thought it would be a nice addition :-)

Not sure how realistic this is, but thought it might be

ThunderFrame

@Duga lol that typo

Comintern

05:08

FML. I have some catching up to do.

7

ThunderFrame

@Comintern OMG, he's alive!!!

Comintern

Back from the dead.

12

ThunderFrame

Among many other things, we get hold of the project's ITypeLib, and we execute code without Application.Run. the possibilities are endless.

@Comintern I hope it wasn't too painful. Welcome back.

Comintern

@ThunderFrame Nice! How does that work? I didn't think it was ever registered with OLE.

@ThunderFrame Stupid contract work with a paranoid no-compete. I'm done with it though.

ThunderFrame

@Comintern there are 2 ways to do it, via the Project Explorer lParams (as I suspected) or by calling a hidden member on the References object using IDispatch. Wayne Phillips of Everything Access/vbWatchdog very kindly revealed the secrets and contributed the code.

Comintern

05:22

Googles CoCreateObject

ThunderFrame

@Comintern Mat got made MVP too.

Comintern

@MathieuGuindon Congrats on making MVP!

Duga

[rubberduck-vba/Rubberduck] Imh0t3b created comment on issue #4019: Rubberduck Nuggets (discussion)

> Great idea!

No more bad code from unkown sources. But shouldn't be collecting and reviewing code the first step? Easy install and update of code is far less important for me.
There should be lots of reviewed code on [codereview.stackexchange.com](https://codereview.stackexchange.com/) that we can start with. So the only thing to solve is the licence problem, then we can start collecting? The rest can be discussed later, let's go!

ThunderFrame

@Comintern the TypeLib magic is here: github.com/rubberduck-vba/Rubberduck/blob/…

IvenBach

@Comintern welcome back!

Comintern

05:25

Does the VBA project get assigned a CLSID?

I want to run me some VBA code from c#.

ThunderFrame

@Comintern IIRC, it does. We haven't done much with the TypeLib yet.

@Comintern see, that's the kind of attitude we've missed.

Comintern

IIR, being able to instantiate a VBA class from inside RD would be killer for unit testing.

ThunderFrame

@Comintern IDK if we cracked that nut yet.

@Comintern as it stands, not requiring Application.Run has meant running in any host, and not requiring Interops and IAppHost implementations for each host.

Comintern

I'm actually more curious about using the objects to probe how the document class extension works.

@ThunderFrame Outlook?

ThunderFrame

@Comintern yep, no more CommandButton tomfoolery. But any host, including WordPerfect and Quattro Pro, neither of which have Application.Run, or CommandButton opportunities

Comintern

05:32

I wonder if there's a way to use that to get a vtable for the object.

Wait, duh.

ThunderFrame

@MathieuGuindon has also finally cracked keyhooks. For now, we have a slightly buggy autocomplete feature, but 2-step hotkeys can't be far away.

Comintern

You can just enumerate the interface and calculate it by offset.

@ThunderFrame I saw that code. Who fixed the ActiveX bindings?

...and more importantly, did that fix the exit crashes?

ThunderFrame

We've been talking about Avalon edit and Dragablz treatable tabs since you first tried it. We think we can do it without using SetParent, by creating a ToolWindow and then making that ToolWindow an MDI Child.

@Comintern crashes were largely RCW related. Wayne was extraordinarily helpful in helping us find leaks and poor handling, and proper disposal. IIRC, it was Wayne, @M.Doerner and @MathieuGuindon. @Vogel612 may have been involved too.

Comintern

What's the thought on interacting with the debugger?

ThunderFrame

@Comintern Wayne can do it to some extent, but he has commerical interests that hold him back on contributing too much. We think, for now, we'll need to fall back to standard code panes for debugging.

Comintern

05:38

I'm trying to remember what I found in my testing. I think there are a couple window messages to listen for - for example, when the debugger asserts it changes the caret position.

ThunderFrame

Here's some HTML mock-up of syntax highlighting that we're hoping for in AvalonEdit.

Comintern

Or you could go full on hack and listen for a repaint, then check the screen buffer to see if a line was highlighted. :-D

ThunderFrame

@Comintern or listen for F8, and then explicitly set the next line

Comintern

I'd go configurable for highlighting. I'm an eye-strain fan, so I use "light" schemes.

(and tiny fonts)

@Comintern likes his screen real estate.

ThunderFrame

BTW, @this, @IvenBach I've now got that HTML working with tooltips on hover, so you get a description of the method/keyword.

@Comintern sure - user configurable. But notice the syntax highlights of literals and other things that the VBE doesn't highlight.

Comintern

05:45

Yeah, I remember that from putting together the configuration for the syntax highlighter in the indenter settings window. It's really versatile.

ThunderFrame

@Comintern I don't think you ever met @this. He's been schooling us in COM since you left.

Comintern

Is the bang notation highlighting as literals?

@ThunderFrame Looking forward to it.

ThunderFrame

@Comintern mine is a JavaScript hack. I don't think we ever had access to your AvalonEdit stuff, or at least I never I inspected the indentation preview code.

@Comintern yeah, I chose to do that on purpose.

Reminds you that your code is flimsy

Comintern

It's kind of like a grammar file for syntax highlight. I'm trying to remember where I put it.

@ThunderFrame LOL

ThunderFrame

I've been using SyntaxHighlighter

Comintern

05:48

Found it.

github.com/rubberduck-vba/Rubberduck/blob/…

ThunderFrame

BBIAB

Comintern

I'm trying to remember if that can be built dynamically. If not, hooking it into the grammar would be a bitch.

IvenBach

Glad you’re back Comintern. I need all the teachers I can get :wink:

Comintern

@IvenBach Thanks. This will be some good cleansing after dealing with my company's website transition to :shudder: ... Wordpress.

IvenBach

Is WP suboptimal?

Comintern

05:58

This implementation is. I really isn't designed for the type of site we run.

this

@ThunderFrame I think you exaggerate a bit. I know enough to fake it but not much more than that. ;-) Welcome back, @Comintern!

Comintern

Crap. Now I need to try and remember how to synch my fork with head.

@this If you know enough to fake it, you know enough to break it. That's my motto.

this

oh yeah, breaking's the easy part. Not getting it to break....

Comintern

lol

Unrelated to RD, but you ever run into COM errors calling an MFC server that shows modal UI from a VBA host?

this

Haven't really worked that much with C++, much less MFC, so no.

IvenBach

06:04

@Comintern git pull upstream next

Comintern

That gets my local, but I need to push local to comintern/Rubberduck.

OK, screw VS2015. Hello terminal window.

this

I think you may need 2017

Hosch upgraded us all to C# 7.2 something.

Comintern

Probably his second choice after F#.

this

also, VS' git leaves much to be desired, IMO.

Comintern

Yeah, 2015 was better than 2013.

IvenBach

06:10

Try : git push origin <branch>

this

Because I'm a lazy chump who can't be bothered to type arcane commands, I usually use TGit plugin which is much better.

IvenBach

I think that’s the syntax

this

That is assuming you have the alias origin defined, of course.

Comintern

I'm a Linux user though, so I'm used to it.

@this That's the piece I'm missing. I need to configure my upstream.

this

IINM, that'd be git remote add origin <URL to your fork>

Comintern

06:14

Should that be the URL to my fork, or the URL to rubberduck-vba?

IvenBach

git-scm.com/docs/git-remote

Your fork

this

^

Comintern

Found my old bash script for it.

IvenBach

Second option in synopsis is the syntax.

I can’t figure out how Mug does all his typing in his phone.

Comintern

@IvenBach Yep, it was that.

Only 197 versions behind.

Wow, only one random downvote on SO since I've been away.

IvenBach

06:28

My efforts to learn git cli paid off. Giving back any way I can.

Night pond.

M.Doerner

07:24

Welcome back @Comintern

Duga

[rubberduck-vba/Rubberduck] comintern created comment on issue #4115: Add "indent error handled block" to indenter settings

> This would likely be a little trickier than it would seem at first glance. The main issue is that the indenter works under the assumption that the code is syntactically correct, so it doesn't really pay attention to whether or not a block of code is "terminated" at all. For example, if you're missing an `End If`statement it will happily rip through to the end of the procedure with the extra indentation level.

That means this would require a fairly substantial architectural change in order

M.Doerner

AFAIR, Wayne tried to create a class via the typelib from the VBE. Unfortunately, he concluded that they did not implement the corresponding function on the interface.

Comintern

@M.Doerner Thanks. Everyone here has been busy by the look of the code.

I'm guessing it's because they're public but not createable.

M.Doerner

The hang/crash on exit bug is still maddening. We had it nearly gone at one point but then it became worse again.

The major problem seems to be that the VBE will kill all its objects right after all add-ins have returned from their shutdown methods. That is not really compatible with the .Net handling of the RCWs.

So, we have to release all COM objects we acquired before shutdown.

@Duga That reminds me, did we fix already the indenter bug with Next z, y, x?

Duga

07:39

[rubberduck-vba/Rubberduck] comintern assigned comintern to issue #4005: Allow different indent settings for Debug statements

[rubberduck-vba/Rubberduck] comintern assigned comintern to issue #4017: Indent deletes and adds empty lines under procedure

[rubberduck-vba/Rubberduck] comintern assigned comintern to issue #3981: Indenter gives wrong indentation when functions are invoked in multiline method calls

[rubberduck-vba/Rubberduck] comintern assigned comintern to issue #3942: Maintain vertical spacing ignores the first member

[rubberduck-vba/Rubberduck] comintern assigned comintern to issue #3943: Indenter doesn't produce proper indentation

Duga

08:23

[rubberduck-vba/Rubberduck] xxxmen starred us

3

Peter M Taylor

09:34

Oh hey @Comintern welcome back indeed. A surprise. Certainly your name came up now and then on good note how you have contributed while us pond members were finding out what’s next or what’s left...

QHarr

10:07

FYI

-1

Q: Since Windows Update kb4340556: VBA COM .NET Automation error on CreateObject()

Since the update Windows7 Update KB 4340556 of the Jul 10, 2018 we get the following error message: "Automation Error" : The system cannot find the file specified" from the Access VBA CreateObject() call. Set ComClass = CreateObject("MyApplication1.InteropStart") Microsoft identifies ...

Seen a couple of users now grumble about it.

Vogel612

11:53

@ThunderFrame I was only standing on the sidelines asking more or less stupid questions for the TypeLib thing

Duga

[rubberduck-vba/Rubberduck] Vogel612 added label feature-autocomplete to issue #4173: Auto-correct for common tpyos...

[rubberduck-vba/Rubberduck] Vogel612 added label enhancement to issue #4173: Auto-correct for common tpyos...

Duga

12:17

[rubberduck-vba/Rubberduck] Vogel612 commented on Rubberduck.Resources/Settings/AutoCompletesPage.de.resx of pull request #4171: German translations for Autocompletion Settings + Issue #4016

[rubberduck-vba/Rubberduck] Vogel612 commented on Rubberduck.Resources/Settings/SettingsUI.de.resx of pull request #4171: German translations for Autocompletion Settings + Issue #4016

this

@Comintern I forgot to mention this but since you're returning, I think you might want to read up on the changes we made to the build process to ensure there's no problems when you are debugging or testing your branch: github.com/rubberduck-vba/Rubberduck/wiki/Contributing

Duga

[rubberduck-vba/Rubberduck] Vogel612 commented on Rubberduck.Resources/Settings/AutoCompletesPage.de.resx of pull request #4171: German translations for Autocompletion Settings + Issue #4016

this

12:29

@QHarr I have the update installed but it apparently doesn't affect me.

QHarr

12:45

@this That is good. Maybe it is a fuss about nothing.

Mathieu Guindon

13:20

@Comintern OMG HE'S ALIVE!!!!!

3

@Comintern thanks!

Mathieu Guindon

13:34

@Comintern I just sent you your R# license key

QHarr

Comintern

@MathieuGuindon Rumors of my demise have been greatly exaggerated.

Mathieu Guindon

well you made the bus factor quite real for a while ;-)

Comintern

I don't doubt it.

Do I need VS2018 to build now?

Mathieu Guindon

VS2017

this

13:48

Blame Hosch. ;-) He wants us to be on the latest and greatest.

Mathieu Guindon

might have something to do with his Roslyn contributions

Comintern

I'll have to check to see if we have licenses here yet. I think we do, but I'm not sure...

Mathieu Guindon

VS2017 Community Edition works too

Comintern

Yeah, I'll probably do that at home but I'd probably want professional here at work.

Mathieu Guindon

also... you missed last year's swag-fest ...I think I might have a RD mug for you somewhere.. what was meant to be your t-shirt ended up going to Wayne

Comintern

13:54

I'll just get RD vanity plates for my car instead.

CallumDA

Hi all, this seems odd. I have a class object with a private type this whos members are exposed by properties. If I place a stop just before the class is destroyed I can type ?class1.this.something in the immediate window and I get the result despite it being private. Perhaps this is expected because you can also see the private this in the locals window but I just found it surprising.

Mathieu Guindon

huh, and you get intellisense on class1.?

is there a default instance?

ThunderFrame

if you're debugging, you can inspect all of the private fields, because the immediate window is in the context of the call stack

change the focus using View..Call Stack, and the field is unreadable, despite the breakpoint still being in the same place.

a debugger that doesn't let you inspect private fields would be pretty unhelpful

this

yes that's expected behavior but even with the class1 prefix?

because that'd be basically trying to access it from outside, rather than within?

Mathieu Guindon

14:09

^

CallumDA

I guess I figured if you want to inspect the private fields I'd need to add the breakpoint somewhere inside the class

I didn't get intellisense on class1.

Mathieu Guindon

ok, at least that is normal

not sure why/how it's letting you prefix it with the class name though

ThunderFrame

@CallumDA The Type and the this instance are both Private and Class1 is not Predeclared?

CallumDA

Yep

(just checking, to make it Predeclared I would have to export and edit with notepad etc.. right?)

Mathieu Guindon

yup

ThunderFrame

14:14

yep, but not for Forms or Sheets, assuming Excel

Mathieu Guindon

or created the class by importing StaticClass.cls like I do :)

ThunderFrame

@MathieuGuindon I think there's an issue for adding a ~~static~~ predeclared class

CallumDA

Yeah - in that case it's not Predeclared, no need for a default instance

Mathieu Guindon

yeah that would have gotten you intellisense on class1. though

CallumDA

makes sense

this

14:15

@MathieuGuindon but only for its public members, no?

Mathieu Guindon

in theory, yes

if Excel could just stop crashing on VBE startup, I could try to repro

this

the This would not be exposed. In theory.

ThunderFrame

@CallumDA how do you instantiate Class1? Dim c as New, or Dim c: Set c = New Class1?

CallumDA

always the latter

this

for me, I get error 424

ThunderFrame

14:16

ditto

this

using this:

Private Type TMe
    foo As String
End Type
Private This As TMe

Private Sub Class_Initialize()
    This.foo = "foo"
End Sub

Private Sub Class_Terminate()
    This.foo = ""
End Sub

Public Sub DoIt()

End Sub

CallumDA

ugh... what have I done

this

and executing via immediate: set x = new Class1: x.DoIt : Set x = Nothing

CallumDA

So far that looks the same as mine

this

This.foo works. Class1.This.Foo results in error 424 (which is what I expect)

(tested in both Class_Initialize and Class_Terminate)

Mathieu Guindon

14:18

@CallumDA got a screenshot?

CallumDA

I just tested the same code and c.this.foo works

for me

?c.this.foo

this

....

Mathieu Guindon

wut

and this is Private

soon on SO/HNQ: "Why is VBA exposing Private parts?"

CallumDA

Class1 is exactly as posted above

this

....

ThunderFrame

14:21

restarted Excel? Or maybe don't - you currently have admin accessibility, and can put that to use ;-)

CallumDA

haha

this

Ok I repro'd

it won't work in immediate window

need the test code that @CallumDA posted above

then ?c.This.Foo will work

Mathieu Guindon

hmm that does ring a bell

has to do with how a Type ends up in the typelib

this

ofc, Debug.Print c.This.foo in the test code => compile error.

and immediate is a project

hmm so if it has access to the project's typelib....

not sure that's an adequate explanation, tho.

Mathieu Guindon

yeah it's shaky. I mean I could conceivably understand how the type gets visibility, but the private field?

this

14:26

OTOH, the accessibility is a lie.

it's only a convention for us mere meatbags to not go in nosing where we don't belong.

ThunderFrame

@this both work for me in immediate window:

Debug.Print c.this.foo
foo
?c.this.foo
foo

this

@ThunderFrame no, i was referring to the first syntax put in the test code's procedure rather inside the immediate window.

ThunderFrame

@this yep, see that now

this

earlier, I was instantiating the whole thing inside the immediate window which did cause error 424.

I think that's a hint. Creating the object in the immediate does not give us access to its private field. however, creating the object in the main VBA project somehow makes it accessible to the immediate "project".

Mathieu Guindon

immediate "project" was never meant for users to use though, so it makes sense that it bends normal accessibility rules

> there is no spoon

ThunderFrame

14:31

oh wow, just set this up Class1 as Public Not Creatable in another project and exposed a factory method, same result

let me try locking the remote project

this

right but it's context-aware.

so if I have this code:

Public Sub x()
    Dim c As Class1
    Set c = New Class1
    y
End Sub

Public Sub y()
End Sub

inside the y, I cannot access c.This.Foo

but inside the x, I can.

Mathieu Guindon

right

this

on second thought, it might be saying more about its scoping than its accessibility...

confirmed. moving Dim c As Class1 to module level Private c As Class1, and then y can access c.This.Foo

Hosch250

Hi, @Comintern!

this

so I don't have to be in any particular place; only need the object to be in scope then I can violate any private members, apparently?

ThunderFrame

14:36

@this yep, and a locked remote project makes no difference, still accessible

this

hmm. in theory that means we can modify a locked project' s private members just by opening a immediate window....

Not sure I like the ramifications of that.

Mathieu Guindon

lol, I guess now we know just how badly MS wanted to kill VB6 in 1999

this

granted there's no intellisense so we have to have some knowledge about its private members.

@MathieuGuindon yeah its power was both a blessing and a curse. Probably more of a curse to the bean counters at MSFT. Back then we were getting news about new virus wrecking millions of computer on a monthly basis, wasn't it?

(how much this has to do with COM/Automation/VB/VBA, IDK. I know there were a number of VBA-based malwares but they're in minority, no?)

Mathieu Guindon

not having much reflection capabilities was the blessing, I guess

ThunderFrame

@this Doesn't seem to matter if it's a String, Type or Class instance. I added a Private class to my remoteProject, and an instance of that to the publicNotCreatable class, and it's completely browsable in Locals Window

this

14:42

@ThunderFrame from POV of debugging, that makes sense. VS is no different, actually.

The main problem however is that the IDE is literally right there with any VBA host. With a typical .NET assembly, you ain't gonna violating any private members unless you install VS, fire up the debugger and attach it to the process, then you get to violate anything you want. But with VBA.... it's only a ctrl+break (or alt + f11) away.

ThunderFrame

still, how do we explain being able to access it via Class1.this.foo?

Mathieu Guindon

that one's still up in the air

ThunderFrame

so any project that offers a write only property is a lie, unless the property is encrypted in the backing field/type member? And how about that ADODB.Connection variable - I can just execute anything I have permissions to execute?

that's very bad

CallumDA

seems I opened a can of worms

ThunderFrame

@CallumDA MS never put the lid on.

this

14:54

actually it jogged my memory -

ThunderFrame

@this And do I get access to a COM library's private members too?

this

Wayne showed that a VBA class can return different ITypeInfo

depending on where you get it from, you may get a full description with all members.

which is why typelib API can also call private members

ThunderFrame

@this Yes, that's the difference between fetching it from the lParams of the Treeview and the References object.

this

but in other place, you only get a stripped down description representing the public members. That is probably what is used in the main VBA project, compared to the immediate project.

@ThunderFrame for some reason, I'm thinking no because in order to invoke it, you need to know there's a member to invoke. If the above is correct, it can only work if the ITypeInfo provides you with that information.

and COM library written in C++ will likely have a IDL that puts a lid on what you get to see via COM. To break that encapsulation, you'll need to go under the COM and deal with raw pointers and hope you don't GPF.

@ThunderFrame I think that's a entirely different issue altogether. Doesn't make it any less stupid, though.

ThunderFrame

OK, there is a way to have a private field, but it is a hack, and won't work with multiple instances of the class... You keep the field in another standard module.

keep it as a public/global variable, or better still, as a private variable, and expose properties

but not a robust solution

this

15:02

This achieves what?

ThunderFrame

and still hackable if you know the variable exists, but at least it doesn't show up in the locals window

@this The class instance has a backing field, and that backing field isn't exposed by Locals.

this

But the thing is that to hack the backing field you have to use immediate/locals.

Not exactly something you can write code to inject something into some other existing code. Unless you're willing to do it using SendKeys

for manual intervention, well, we're screwed but that's nothing different from the fact that code is already there in the editor.

ThunderFrame

@this retrieving a password from a backing field is a pretty big hack. So is being able to execute SQL against a DB connection - The Locals window exposes all of the in scope variables, and immediate window lets you manipulate them - even if that's one line at a time, you can cause some pretty major damage

this

which is why it shouldn't be stored.

ThunderFrame

@this and a connection object? Do you reconnect every time?

this

15:08

easier done in DAO than ADO, unfortunately.

with ADO, persistent connections are problematic. For that reason, you probably need to use APIs.

1

Q: Private storage for at-rest data in VBA

One major annoyance in VBA programming is that it's hard to keep a secret secret. In this particular case, it's the ADODB.Connection. For reasons not germane to the post, it is necessary to be able to re-create new instances of ADODB.Connection, which also implies filling in the connection string...

vba security memory-management

based on the discussion, though, the above probably need to be improved if you want to harden it from immediate/locals probing.

ThunderFrame

either way, I'm realizing that I may have written some somewhat less secure code than I'd thought. Takes comfort in the fact that I'm not the first to admit that

this

Yes. That's why I tell anyone who think they found a way to secure their assets that it's much easier to fool oneself into thinking it secure than to actually secure it.

That applies to myself just as much, as well.

ThunderFrame

I always considered viewing the actual code modules to be insecure, but not the runtime fields quite as easily as they are

Duga

15:57

[rubberduck-vba/Rubberduck] carlossierra311 opened issue #4174: False Positives for Builtin Functions and Constants

> I am getting close to 200 Code Quality Issues for things like constants and built-in functions. As an example, see the following image:
![falsepositives](https://user-images.githubusercontent.com/23511373/42583883-89aaf538-84f7-11e8-8dec-0438fa51d415.png)

The MsgBox line alone generates 6 issues (the 3 shown in the image, plus 3 more further down the issues list for those same "variables" not being assigned).

Other variables and functions that generate issues are: Err, xlUp, xlToLeft,

[rubberduck-vba/Rubberduck] carlossierra311 edited issue #4174: False Positives for Builtin Functions and Constants

IvenBach

@this I'm trying to follow the implications. Is this just dealing with things in the standard code module window, the immediate window, or the locals window?

this

1 hour ago, by ThunderFrame

@this retrieving a password from a backing field is a pretty big hack. So is being able to execute SQL against a DB connection - The Locals window exposes all of the in scope variables, and immediate window lets you manipulate them - even if that's one line at a time, you can cause some pretty major damage

IvenBach

Just got it figured out a moment ago.

That's... Very scary.

Comintern

16:21

Is strangling WordPress developers illegal, or is there some sort of exemption for that?

2

Duga

[rubberduck-vba/Rubberduck] retailcoder created comment on issue #4174: False Positives for Builtin Functions and Constants

> I bet the initial parse took much longer than usual, and that the logs (if enabled) contain exceptions involving the COM collector, saying something to the effect of "type library 'VBA' could not be loaded"... this has been a problem relatively recently, but it seems to have been fixed.

Is this a debug build? The mismatching version numbers bug (splash screen vs about box showing different version numbers) was fixed relatively recently; does the current/latest pre-release build have the sam

Mathieu Guindon

@Comintern there's always Twitter :)

(and poop emojis)

Comintern

lol

I thought about a Google review, but I'd probably get fired.

Strangling would probably be a terminatable offense too. Although I'd likely get more sympathy from my co-workers...

Mathieu Guindon

lol

in other news, I recorded a podcast (in French) Monday night with Montreal MVPs Guy Barrette and Mario Cardinal; they're working on the editing, recording will probably go public at some point next week - we can expect ~1.5K French-speaking devs to hear it, so possibly another round of GitHub stars coming up

(and maybe a contributor or two if we're lucky)

Duga

[rubberduck-vba/Rubberduck] carlossierra311 created comment on issue #4174: False Positives for Builtin Functions and Constants

> No, parsing didn't take a particullarily long time.
I'll try the latest pre-release and let you know if the issues are fixed there.

IvenBach

16:33

@MathieuGuindon Wut 'bout us 'Murikens? Go'cha English vurzhun?

Mathieu Guindon

I'll put up a translated transcript on RD news when it's live :)

IvenBach

:+1: Thanks.

this

@ThunderFrame Here's a different take that I think produce similar effects to what you describe (no visibility in the Locals window but still can be executed if you know the private name)

IvenBach

After listening to yourself for a while you'll say "Do I really sound like that?".

Mathieu Guindon

I know >_<

this

16:34

Private Function BaseAddress_Private(Optional NewValue As Variant) As LongPtr
    Static Value As LongPtr

    If IsMissing(NewValue) Then
        BaseAddress_Private = Value
    Else
        Value = NewValue
    End If
End Function

Vogel612

@IvenBach that's pretty devastating when you sing with a microphone for the first time

IvenBach

In my own head I sound sexy and suave. Any recording is just a false bastardized imposter version of me.

Duck check: When designing a method any guard clauses should be done on the method and not a UI check before the method?

Just found that a Range("J8").GoalSeek Goal:=4.2, ChangingCell:=Range("G8") that has a formula =10+1 in G8 gets a helpful message when using the UI "Cell must contain a value" and RTE1004 when programatically called.

J8 is just =SQRT(G8)

Mathieu Guindon

16:51

@IvenBach haha that's why I don't record voicemail greeting messages

> I'm not here, you know what to do. [BEEP]

IvenBach

@Vogel612 This happen to you?

Vogel612

basically every time I do it, because I do it so rarely

ThunderFrame

17:32

@this yeah, that occurred to me. And you can add an extra parameter to Properties too.

this

hmm. so an extra parameter on properties removes it from locals? Interesting and also more cleaner.

Unfortunately none of that prevents immediate from accessing those, tho.

Mathieu Guindon

parameterized properties are meant to be used as indexers...

ThunderFrame

@this well, I didn't bother checking, but I assume so. Just like adding a parameter to a procedure will remove it from the Macros dialog.

@MathieuGuindon properties are meant to enable access to private fields...

this

confirmed.

but still accessible via immediate, tho.

it should be noted however that Watch can likewise circumvent those limitations.

and frankly that only adds obscurity, not any real security.

I think that if it's big enough of a problem, you have no choice but to introduce external dependencies

ThunderFrame

17:55

@this IKR, along with all of the deployment hassles that that entails.

this

using vbDotNetLoader it can be xcopy deployment.

for small enough DLLs, I just stuff them in a local Access table and extract them at runtime.

ThunderFrame

They should rename it the Immediate Access Window.

this

The problem, though is that being .NET can be just as porous; you'd need to take extra care with how you compile the .NET assembly so that reflection won't help them out either.

Transcript for