Enterprise Library Test Guide - Willy .Net

144
Enterprise Library Test Guide
Check
Yes
Description
Assemblies can include declarative security attributes that are implemented with the
.NET Framework SecurityAction.RequestMinimum enumeration. This enumeration
requests the minimum permissions required for the code to run. The run time loads the
assemblies only if the security policy can grant them the permissions they need. Additionally,
specifying the necessary permission level in the code lets administrators know
what the application needs to successfully load. The following example shows how the
Logging Application Block’s AssemblyInfo.cs file requests permissions.
[assembly: ReflectionPermission(SecurityAction.RequestMinimum, Flags =
ReflectionPermissionFlag.MemberAccess)]
[assembly: FileIOPermission(SecurityAction.RequestMinimum)]
[assembly: EventLogPermission(SecurityAction.RequestMinimum)]
[assembly: MessageQueuePermission(SecurityAction.RequestMinimum, Unrestricted
= true)]
[assembly: PerformanceCounterPermission(SecurityAction.RequestMinimum)]
Class-level Checklist
Table 33 lists the class-level recommendations.
Table 33: Class-level Checklist
Check
Yes
Yes
Yes
Description
Restrict the visibility of classes and their members. Use the most restrictive access
modifier you can. Use private where possible.
Seal non-base classes.
Validate all input that originates outside of the current trust boundary. Check the input
to see that it is the proper type, length, format, and range. The following example shows
how the Logging Application Block checks the input for non-NULL values and valid files.
Public FileConfigurationSource(string configurationFilepath)
{
if (string.IsNullOrEmpty(configurationFilepath)) throw new
ArgumentException(Resources.ExceptionStringNullOrEmpty,
"configurationFilepath");
this.configurationFilepath =
RootConfigurationFilePath(configurationFilepath);
}
if (!File.Exists(this.configurationFilepath)) throw new
FileNotFoundException(string.Format(Resources.Culture,
Resources.ExceptionConfigurationLoadFileNotFound,
this.configurationFilepath));
EnsureImplementation(this.configurationFilepath);