From b0f7871eecd9380f81a111de001b32a4cdd821fa Mon Sep 17 00:00:00 2001
From: Takoooooo <tako0qq@gmail.com>
Date: Mon, 30 May 2022 19:14:37 +0300
Subject: [PATCH 1/2] Don't allow bindings to private methods.

---
 .../Data/Converters/DefaultValueConverter.cs  |  9 +++++-
 .../Data/BindingTests_Method.cs               | 32 +++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 tests/Avalonia.Markup.UnitTests/Data/BindingTests_Method.cs

diff --git a/src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs b/src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs
index 11d50afe93..e531cfd7be 100644
--- a/src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs
+++ b/src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs
@@ -33,7 +33,14 @@ namespace Avalonia.Data.Converters
 
             if (typeof(ICommand).IsAssignableFrom(targetType) && value is Delegate d && d.Method.GetParameters().Length <= 1)
             {
-                return new MethodToCommandConverter(d);
+                if (d.Method.Attributes.HasFlag(System.Reflection.MethodAttributes.Private) == false)
+                {
+                    return new MethodToCommandConverter(d);
+                }
+                else
+                {
+                    return new BindingNotification(new InvalidCastException("You can't bind to private methods!"), BindingErrorType.Error);
+                }
             }
 
             if (TypeUtilities.TryConvert(targetType, value, culture, out var result))
diff --git a/tests/Avalonia.Markup.UnitTests/Data/BindingTests_Method.cs b/tests/Avalonia.Markup.UnitTests/Data/BindingTests_Method.cs
new file mode 100644
index 0000000000..e613a178d5
--- /dev/null
+++ b/tests/Avalonia.Markup.UnitTests/Data/BindingTests_Method.cs
@@ -0,0 +1,32 @@
+using Avalonia.Controls;
+using Avalonia.Data;
+using Avalonia.Input;
+using Avalonia.Interactivity;
+using Xunit;
+
+namespace Avalonia.Markup.UnitTests.Data
+{
+    public class BindingTests_Method
+    {
+        [Fact]
+        public void Binding_To_Private_Methods_Shouldnt_Work()
+        {
+            var vm = new TestClass();
+            var target = new Button
+            {
+                DataContext = vm,
+                [!Button.CommandProperty] = new Binding("MyMethod"),
+            };
+            target.RaiseEvent(new RoutedEventArgs(AccessKeyHandler.AccessKeyPressedEvent));
+
+            Assert.False(vm.IsSet);
+        }
+
+
+        class TestClass
+        {
+            public bool IsSet { get; set; }
+            private void MyMethod() => IsSet = true;
+        }
+    }
+}

From 83b5338a2855b7a0e1643c810895ebd3f765d1bc Mon Sep 17 00:00:00 2001
From: Takoooooo <tako0qq@gmail.com>
Date: Mon, 30 May 2022 19:51:36 +0300
Subject: [PATCH 2/2] Check for method being Private correctly.

---
 src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs b/src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs
index e531cfd7be..c4f4362537 100644
--- a/src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs
+++ b/src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs
@@ -33,7 +33,7 @@ namespace Avalonia.Data.Converters
 
             if (typeof(ICommand).IsAssignableFrom(targetType) && value is Delegate d && d.Method.GetParameters().Length <= 1)
             {
-                if (d.Method.Attributes.HasFlag(System.Reflection.MethodAttributes.Private) == false)
+                if (d.Method.IsPrivate == false)
                 {
                     return new MethodToCommandConverter(d);
                 }