Why not reveal the type and identity of the source to the client?

Question

On page 220, the C# Language Specification Version 5.0 says:

It is important ... to ensure that the result of a query expression is never the source object itself, as that would reveal the type and identity of the source to the client of the query.

Why would it be problematic to reveal the type and identity of the source to the client of the query?

As an example, a query expression of the form from c in customers select c translates into customers.Select(c => c) instead of just customers.

In the above case, it seems to me that returning customers to the client would be just as good as returning the results of customers.Select(c => c). Why isn't it?

Answer 1

Though Robert McKee's answer is plausible and raises an interesting point, it is not actually the primary issue that we had in mind when writing that section of the specification. The issue we actually had in mind was this:

class C 
{
  private List<int> myList = new List<int>();
  // Only the code in C can add items to the list.
  public IEnumerable<int> Items 
  {
    get
    {
      return from item in myList select item;
    }
  }
}

Suppose you have a C in hand. Should you be able to write this code?

((List<int>)c.Items).Add(123);

The existence of a query on a list should not grant code which obtains the query the ability to change the list! It should grant that code the right to execute the query and no more.

Now imagine that instead of a List<int>, the query is actually wrapping a database call. If the caller can obtain the underlying database from the query then perhaps they can make queries or edits to that database that the author of the query did not intend them to make.

Of course, LINQ is not designed to be a security system, and if it is your only line of defense against code that wants to attack your database, you're probably pretty vulnerable. But all security systems work better when their components use good "defense in depth". Not ever leaking the collection that a query is querying is part of a defensive strategy.

For more on this feature, see my article on the subject:

https://web.archive.org/web/20150905090133/http://blogs.msdn.com/b/ericlippert/archive/2008/05/12/trivial-projections-are-usually-optimized-away.aspx