Don't allow assemblies in the plugin folder to inject protected services

src/Artemis.Core/Ninject/CoreModule.cs

@@ -1,8 +1,12 @@
-using Artemis.Core.Exceptions;
+using System;
+using System.IO;
+using System.Linq;
+using Artemis.Core.Exceptions;
 using Artemis.Core.Plugins.Models;
 using Artemis.Core.Services;
 using Artemis.Core.Services.Interfaces;
 using Artemis.Storage.Repositories.Interfaces;
+using Ninject.Activation;
 using Ninject.Extensions.Conventions;
 using Ninject.Modules;
 using Serilog;
@@ -26,14 +30,14 @@ namespace Artemis.Core.Ninject
                     .Configure(c => c.InSingletonScope());
             });
 
-            // Bind all protected services as singletons TODO: Protect 'em
+            // Bind all protected services as singletons
             Kernel.Bind(x =>
             {
                 x.FromThisAssembly()
                     .SelectAllClasses()
                     .InheritedFrom<IProtectedArtemisService>()
                     .BindAllInterfaces()
-                    .Configure(c => c.InSingletonScope());
+                    .Configure(c => c.When(HasAccessToProtectedService).InSingletonScope());
             });
 
             // Bind all repositories as singletons
@@ -45,9 +49,14 @@ namespace Artemis.Core.Ninject
                     .BindAllInterfaces()
                     .Configure(c => c.InSingletonScope());
             });
-            
+
             Kernel.Bind<PluginSettings>().ToProvider<PluginSettingsProvider>();
             Kernel.Bind<ILogger>().ToProvider<LoggerProvider>();
         }
+
+        private bool HasAccessToProtectedService(IRequest r)
+        {
+            return r.ParentRequest != null && !r.ParentRequest.Service.Assembly.Location.StartsWith(Path.Combine(Constants.DataFolder, "plugins"));
+        }
     }
 }