Does Using MEF and using inherited export on an interface leave my code open to vunerabilities?

Question

So I am using MEF to dynamically load plugins into my application.

I build up a DirectoryCatalogue like so:

//An aggregate catalog that combines multiple catalogs
var catalog = new AggregateCatalog();

foreach (var path in Directory.EnumerateDirectories(Properties.Settings.Default.PluginDirectory, "*", System.IO.SearchOption.TopDirectoryOnly))
{
     catalog.Catalogs.Add(new DirectoryCatalog(path));
}
// Create the CompositionContainer with all parts in the catalog (links Exports and Imports)
var container = new CompositionContainer(catalog);
//Fill the imports of this object
container.ComposeParts(this);

and have a property that is marked as import:

    [ImportMany]
    public ObservableCollection<ISyncPlugin> SyncPlugins
    {
        get;
        set;
    }

But I cant help but feel like exporting an interface leaves my program open to vunerabilities. If a coder works out that my interface is being exported they can implement my interface and write malicious code that will be loaded and run by my program. Is there a better way to do this?

Answer 1

The idea behind the plugin structure is to allow others to write extensions for your program. That is, you are giving access to your program and giving others permission to whatever they want. If you need to prevent plugins from performing certain actions you would have to do just that.

See the note on "Security" here:
How To Control Who Can Write Extensions For Your MEF Application