Enterprise Library Test Guide - Willy .Net

150
Enterprise Library Test Guide
Delegates Checklist
Table 37 lists the delegates recommendations.
Table 37: Delegates Checklist
Check
Yes
Description
Delegates should not be accepted from untrusted sources. In Enterprise Library, it is
possible to use external configuration sources. This threat is documented in the code
so that users are aware of it. The following code example shows this documentation.
LogEntry log = new LogEntry();
log.Message = "memory leak";
log.Categories.Add(DropDownList1.SelectedValue);
log.Priority = 0;
log.EventId = 100;
log.Severity = TraceEventType.Information;
FileConfigurationSource source = new
// This configuration source comes from an external source.
// Only use configuration sources that come from
// trusted sources.
FileConfigurationSource(@"c:\pag\FileSource.config");
LogWriterFactory factory = new LogWriterFactory(source);
LogWriter writer = factory.Create();
writer.Write(log);
writer.Dispose();
Serialization Checklist
Table 38 lists the serialization recommendations.
Table 38: Serialization Checklist
Check
Yes
Description
Any type that implements the ISerializable interface or derives from such a type should
protect the GetObjectData method with a serialization formatter security action. In the
Security Application Block, the SyntaxException type implements the GetObjectData
method and protects it with the SecurityAction.Demand enumeration. This means that
all callers higher in the call stack must have been granted the permission specified by
the current permission object. The following example shows how the Security Application
Block protects the GetObjectData method.
public class SyntaxException : Exception
{
[SecurityPermission(SecurityAction.Demand, SerializationFormatter=true)]
public override void GetObjectData(SerializationInfo info, StreamingContext
context)
{
base.GetObjectData(info, context);
info.AddValue(IndexKey, this.index);
}