Merge pull request #8228 from AvaloniaUI/dont-allow-bindings-to-private-methods

Don't allow bindings to private methods

src/Avalonia.Base/Data/Converters/DefaultValueConverter.cs

@@ -33,7 +33,14 @@ namespace Avalonia.Data.Converters
 
             if (typeof(ICommand).IsAssignableFrom(targetType) && value is Delegate d && d.Method.GetParameters().Length <= 1)
             {
-                return new MethodToCommandConverter(d);
+                if (d.Method.IsPrivate == false)
+                {
+                    return new MethodToCommandConverter(d);
+                }
+                else
+                {
+                    return new BindingNotification(new InvalidCastException("You can't bind to private methods!"), BindingErrorType.Error);
+                }
             }
 
             if (TypeUtilities.TryConvert(targetType, value, culture, out var result))

tests/Avalonia.Markup.UnitTests/Data/BindingTests_Method.cs

@@ -0,0 +1,32 @@
+using Avalonia.Controls;
+using Avalonia.Data;
+using Avalonia.Input;
+using Avalonia.Interactivity;
+using Xunit;
+
+namespace Avalonia.Markup.UnitTests.Data
+{
+    public class BindingTests_Method
+    {
+        [Fact]
+        public void Binding_To_Private_Methods_Shouldnt_Work()
+        {
+            var vm = new TestClass();
+            var target = new Button
+            {
+                DataContext = vm,
+                [!Button.CommandProperty] = new Binding("MyMethod"),
+            };
+            target.RaiseEvent(new RoutedEventArgs(AccessKeyHandler.AccessKeyPressedEvent));
+
+            Assert.False(vm.IsSet);
+        }
+
+
+        class TestClass
+        {
+            public bool IsSet { get; set; }
+            private void MyMethod() => IsSet = true;
+        }
+    }
+}