Seal methods that satisfy private interfaces

Interface methods have public accessibility, which cannot be changed by the implementing type. An internal interface creates a contract that is not intended to be implemented outside the assembly that defines the interface. A public type that implements a method of an internal interface using the virtual (Overridable in Visual Basic) modifier allows the method to be overridden by a derived type that is outside the assembly. If a second type in the defining assembly calls the method and expects an internal-only contract, behavior might be compromised when, instead, the overridden method in the outside assembly is executed. This creates a security vulnerability.

An inheritable public type provides an overridable method implementation of an internal (Friend in Visual Basic) interface.

To fix a violation of this rule, prevent the method from being overridden outside the assembly by using one of the following:

• Make the declaring type sealed (NotInheritable in Visual Basic).

• Change the accessibility of the declaring type to internal (Friend in Visual Basic).

• Remove all public constructors from the declaring type.

• Implement the method without using the virtual modifier.

• Implement the method explicitly.

It is safe to suppress a warning from this rule if, after careful review, no security issues exist that might be exploitable if the method is overridden outside the assembly.