@ThunderFrame at least you know what you’re doing. 18yr old me couldn’t understand it at all. Reflected by the F I would have received had I not dropped before the last date to do so.
[rubberduck-vba/Rubberduck]comintern pushed commit 12718a19 to next: Fix over-zealous caching regression from #4039. This should close all outstanding ComReflection issues. Ref: #4045, #4091, #4174, and probably others.
speaking of in synch, if you have modules that you like to put into multiple projects, how do you keep them up to date, when changes are required? Ordinarily you'd use source control, but until a viable solution comes along, what if we were to add a GUID annotation to a module, and then house the master-modules in an add-in, or as a text file repository, so an add-in remains light weight and host-specific add-ins can share the repository, and then the add-in can check the GUIDs and prompt the user to update the modules based on the GUID?
Although I my case I was targeting a CHM. Management loves those for some reason.
Do we have tests that rely on broken behavior in the serialized assemblies? I made an indenter change, but all of the failing tests look related to the Excel specific function inspections. Weird.
I did serialize after that PR, but the unit tests should be pulling from the ones in the test files folder, no?
> Noticed this after I serialized declarations to scan through them to validate the COM collector output. Next time I ran unit tests after that, I failed all of the Excel specific ones. I deleted them from my Declarations folder, and then :poof: all tests passed again.
This has 2 implications. First, the cached declarations might not be current enough for the unit tests to be effective (otherwise they shouldn't care which declaration set they were using). Second, unit tests should be repeat
Critical COM type library loader regression bug introduced a few weeks ago is finally fixed!
Kudos @CominternVBA!
https://github.com/rubberduck-vba/Rubberduck/releases/tag/Rubberduck-v2.2.0.3496
I'm still playing around with stop-gap fix for attaching to windows. I'm trying to find a decent event to use - enumerating all of them at the start is a recipe for disaster if RD and VBE are both starting up at the same time.
RD gets in there just at the point where objects have been created, but they aren't ready for use.
@MathieuGuindon yeah, I suppose it's reinventing the wheel to a certain extent.
@IvenBach I never claim to know what I'm doing. I have moments of absolute frustration with sometimes trivial problems, and punch-the-air moments of jubilation when something finally works. Don't ever think that you have learnt enough, keep challenging yourself, and you'll start to appreciate your achievements and yearn for new challenges.
That's actually what it's designed for. We outsourced our company website to a WordPress developer (it was in aspx before), and it's been a complete nightmare.
It's not even that big. The contractor is taking ages on simple stuff too - like they took 3 full days to get an email generated by a form to go to the correct addresses and in the correct format.
The guy who was working on it was making changes hourly for the entire time too. I seriously think he had to be on meth or something.
They also didn't account for the fact that all of our external back-links that had to still work were not case sensitive, but moved us from a Windows Server to a Linux LAMP machine. It's been completely amateur-hour.
@Comintern so the LAMP cost savings are already eaten up, several fold, by paying the contractor. Seems to me he knows how to run a lucrative contracting business. I'm unsure how long it can last, if you're ever asked for a reference.
ouch @Comintern. Umm, I've taken some time reading about generating documentation and learnt there are a few XML generators. you mentioned Sandcastle being one to use that appears to have a Standalone GUI interface. The other one is DocFX I learnt which .NET can also parse into a markdown file. dotnet.github.io/docfx/tutorial/docfx_getting_started.html.
> This appears to have nothing to do with the inspection - looks like it was defaulting the return type to Object because the VBA type library didn't load correctly. This works fine after the changes in #4181. Status bar shows Split returning a Variant, and the inspection is not triggered with the sample code above.
@PeterMTaylor I played around with DocFX for a while. I went with SandCastle mainly because it integrates with Visual Studio, so it's trivial to add document generation to the build process.
There was another one that I played with, but the name escapes me ATM.
I've got my HTML Syntax highlighter working nicely, including a custom highlight for RD annotations, and by hacking the script a little, I've even been able to get the mouse-hover to show a tooltip explaining what the statement does.
When AvalonEdit comes along, in addition to a real statusbar, we could also have mouse-hover documentation for keywords and declarations.
okay. be offline now got my daughter's desk to build from a flatpack. not IKEA. :) Also on holidays for a week so would see if I can move along with what I have on my side of things.
@IvenBach until I get an animation of a fuller codepane, here's a codepen example of HTML mouse-over on Option Base statements. Just place your mouse over the statements in the bottom pane.
@this I've had a play with the DataVault, setting it up as PublicNotCreatable in an add-in. I'm confused. It doesn't seem secure at all because of the leaky Immediate Window. I had already tried the static variable approach in my own attempt to defeat the Immediate Window, but despite the Execute method being Private, the immediate window will happily run not only WriteData and ReadData, but also Execute.
That is, if you can work out the arguments for Friend/Private members, then the Immediate Window can easily access and modify the data.
@MathieuGuindon If I type ElseIf foo = 1{Enter}, does the keyhook catch the {Enter} early enough to have AC automatically add the missing Then, and subsequently prevent the Compiler Error: Expected Then?
because I keep doing that, and it's driving me nuts
@MathieuGuindon Also, if I place the cursor to the left of an If statement, and then press {enter}, AC adds an End If statement, and keeps the cursor where it was, without inserting a new line, which was my intention. AC should be able to tell my intention based upon the cursor location. IDK - maybe you already fixed this?
> Creating a predeclared class is tedious. You can add a class, export and remove it, edit and save the attribute in an external editor, reimport the class, and then rename the class to the required name. If you're organised, you might have a predeclared class file, but you still need to navigate to it and import, hoping there aren't naming conflicts and then rename it.
RD should have a command that prompts for a name, and then automatically creates a predeclared class.
> Recent versions of VBA allow for a project to reference another project created by the same host.
If you have an existing project, say an add-in, and you'd like to create a new project that refers to that add-in, you have to switch to the host, add a new document, switch back to the VBE, ensure the project's don't have the same name, then use the references dialog to add the reference from the new project to the add-in project.
It would be useful if RD allowed you to complete all of thos
> If you'd like to change the names, or the Instancing/predeclared attributes, or the description attributes of multiple class modules, you have to do everything through the Properties ToolWindow and,/or exporting and importing the module. It would be very useful if you could open a form with a listing of every class, and its attributes, and allow a user to update each of them, as required, in one place, and then, upon hitting Apply, have all of the attributes update.
@this, re DataVault, I think I've found a way to make it work by adding an optional "key" parameter to Execute with a type of Variant. But the key isn't a string or number: in order for Execute to succeed, TypeOf key Is PrivatelyInstancedClass must return true. There's no way for the add-in client to instantiate a PrivatelyInstancedClass, so there aren't any brute force opportunities for cracking the key.
I have just pulled the latest version of RD from the repository and the add-in doesn't want to start
`--------------------------- Rubberduck Add-In could not be loaded --------------------------- Castle.MicroKernel.ComponentActivator.ComponentActivatorException: ComponentActivator: could not instantiate Rubberduck.UI.Inspections.InspectionResultsDockablePresenter ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Runtime.InteropServices.COMException: Invalid class string. (Exception from HRESULT: 0x800401F3 (CO_E_CLASSSTRING))`
is there something that needs to be done before I can run it?
@ThunderFrame My point was that the BaseAddress variable cannot be exposed in that way. Yes, You can execute even the Execute but you never can find the value BaseAddress, short of actually stepping code inside the Execute method. By same logic, you could get the same "security" by storing the sensitive info in a static variable. BTW, I also wasn't thinking of add-in but of storing it in a *DE file (e.g. a single VBA library that's stripped of source code).
@ThunderFrame I do not think that will work in a single VBA library where you have access to the private classes? Using a 2nd library, you can use the project boundary to your advantage and that's good. But with a standalone *DE file and assuming you don't want to deal with a 2nd *DE file, the options to me basically seems limited to storing the sensitive information inside the static variable.
@Kapol could you check if you are able to start RD with no addins or any extras enabled?
@this I looked the other day. The unviewable product just hides the modules, all the source code is still there, but they have a new product that removes the code. I'm unsure if they also remove the p-code.
@ThunderFrame That's your data, no? For a class that needs to hold sensitive information, they could instantiate a private instance of DataVault and not expose it publicly; encapsulating the access to the WriteData/ReadData, right?
> I made the major and minor reference mandatory in MockProjectBuilder.AddReference. The problem with this is that it is not abvious that you have to provide them when referencing a library in tests. In paricular, there have been two tests referencing the Excel object model, where the major version 1 and minor version 8 had not been provided. Before, the versions simply defaulted to 0, which is not too helpful. I would like to add that I am not too happy with the current design since...
it is possible to reference other projects that do not have a version number, e.g. other Excel workbooks.
@this You're suggesting that an ACCDB (client) can call code from the MDE (add-in)? If the client can step code, utilising a class from MDE, and the MDE class uses a non-static DataVault instance, then IIUC, the client can see the DataVault, and, if they can guess the signatures, call DataVault members.
@ThunderFrame No, no. That's still 2 VBA projects with a clear boundary. I'm talking about a single VBA project -- e.g. a single *DE file, so you cannot use the VBA project boundary to protect access.
> # [Codecov](https://codecov.io/gh/rubberduck-vba/Rubberduck/pull/4186?src=pr&el=h1) Report > Merging [#4186](https://codecov.io/gh/rubberduck-vba/Rubberduck/pull/4186?src=pr&el=desc) into [next](https://codecov.io/gh/rubberduck-vba/Rubberduck/commit/93f51434821ddf0f6ab13ee3f1e30f1003690bad?src=pr&el=desc) will **decrease** coverage by `<.01%`. > The diff coverage is `n/a`.
@this so the MDE is a complete database with stripped-out source code. And you trigger code by interacting with commandbars, forms and reports? There are no breakpoints, you can see OB and Immediate Window, but you can't halt code or step code? But while you can potentially execute procedures and predeclared members from immediate window, does it give you access to anything else?
Isn't DataVault overkill at that point, as all class instances are unreachable, or are you purely concerned about blackhats finding values via memory analysis?
@ThunderFrame You got it all correct. No way to step the code but you can call public methods. Hmm. Does that means predeclared instance leak their private member?
@ThunderFrame Yes. The original scenario was to securely store a password because ADO is stupid.
Well, the deployment project automatically cleans the previous version's registration. Furthermore, the registration are present - it is simply that the security policy does not permit use of HKCU from an admin process.
so even though the registry keys are all in their place, you will not be able to load the addin; you get a message from the host saying unable to load missing extension.
Hmm. My understanding is that you wouldn't be even be able to load it at all.
@this just tried with a locked XLSM (not quite the same as an MDE), but while UserForms.Count returns 0, the predeclared UserForm1 has a public and a private function. Both are callable from the immediate window
---------------------------
Microsoft Visual Basic for Applications
---------------------------
'Rubberduck' could not be loaded.
Remove it from the list of available Add-Ins?
---------------------------
Yes No Help
---------------------------
so, I suppose my question is this. DataVault isn't of much use as a module level variable. It might be useful as a procedure level variable, static or otherwise, but it's arguably no safer than a normal procedure level variable, aside from the ability to inspect memory?
@ThunderFrame I think it's more broad than that. If you have anything you want to keep private, you must use static variables to hide the access from the immediate window.
@mansellan and you said you cannot run VS non-admin?
@this OK, so I tried running VS as both as admin and non-admin, clean the solution and debug with F5 (normally I open an Excel file and then attach the debugger manually). Same error in both cases.
@Kapol Right. Attaching to process does not have the problem with admin privileges which is why it wasn't a concern for you. F5'ing would have been a problem. I just want to make 1000% sure -- are you starting from Rubberduck.Deployment project?
so i checked the actual devenv.exe.. the icon itself has an admin badge, and properties don't have any option for admin or otherwise. double-clicking it brings up UAC.
@ThunderFrame memory protection of the content, basically. That was the whole point when I originally wrote the class. In that context, the BaseAddress shouldn't be leaked outside the consuming class' use. But to secure the access to the string that's WriteData/ReadData, you have to take steps to ensure that the private instance itself isn't leaked, too.
I reloaded the project and set it as start-up, but I can't build the solution anymore
The command "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -command "C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment\PreInnoSetupConfiguration.ps1 -WorkingDir C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment\" exited with code 1. Rubberduck.Deployment
@this The BaseAddress is only sensitive because it would reveal the string data in memory, but because the ReadData and WriteData already jeopardise the data, the security of BaseAddress is moot, if the DataVault instance isn't secure?
@ThunderFrame which implies that the consuming class has to use it as a static procedure level. Or all consuming classes must be composed from the hypothecial TheRootOfEverything class.
That's why I see it as much more bigger problem than what DataVault was aiming to do.
C:\Users\Radek\Documents\Visual : The term 'C:\Users\Radek\Documents\Visual' is not recognized as the name of a cmdlet, 9> function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the 9> path is correct and try again. 9> At line:1 char:1 9> + C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubbe ... 9> + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 9> + CategoryInfo : ObjectNotFound: (C:\Users\Radek\Documents\Visual:String) [], CommandNotFoundException
if it was that simple, everyone else would have screamed at me already
ok in deployment's build events
you have both pre and post event
in pre, we have C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -command "$(ProjectDir)PreInnoSetupConfiguration.ps1 -WorkingDir $(ProjectDir)
change it to C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -command "$(ProjectDir)PreInnoSetupConfiguration.ps1 -WorkingDir '$(ProjectDir)'
@PeterMTaylor @IvenBach Here's the gif - some descriptions are a little short, but this is just a proof of concept for HTML - AvalonEdit would work slightly differently.
error MSB3073: The command "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -command "C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment\PreInnoSetupConfiguration.ps1 -WorkingDir 'C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment\'" exited with code 1.
the quotes in the pre-build event don't matter
maybe it's something inside the PowerShell script itself?
and put in $(ProjectDir)PreInnoSetupConfiguration.ps1 -WorkingDir '$(ProjectDir)', replacing the $(ProjectDir) with `C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment`
(you may have to first do Set-ExecutionPolicy -Bypass before you run the command above)
"C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment\PreInnoSetupConfiguration.ps1 -WorkingDir \"C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment\""
@Kapol 'C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment\PreInnoSetupConfiguration.ps1' -WorkingDir 'C:\Users\Radek\Documents\Visual Studio 2015\Projects\Rubberduck\Rubberduck.Deployment\'
VBA Rubberducking
VBA Rubberducking