CA1417: Do not use OutAttribute on string parameters for P/Invokes

Cause

A P/Invoke string parameter is passed by value and marked with OutAttribute.

Rule description

The .NET runtime automatically performs string interning. If an interned string marked with OutAttribute is passed by value to a P/Invoke, the runtime can be destabilized.

How to fix violations

If marshalling of modified string data back to the caller is required, pass the string by reference instead. Otherwise, the OutAttribute can be removed without any other changes.

 // Violation
[DllImport("MyLibrary")]
private static extern void Foo([Out] string s);

// Fixed: passed by reference
[DllImport("MyLibrary")]
private static extern void Foo(out string s);

// Fixed: marshalling data back to caller is not required
[DllImport("MyLibrary")]
private static extern void Foo(string s);

When to suppress warnings

It is not safe to suppress a warning from this rule.

See also

• Interoperability rules
• Native interoperability best practices