Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 151
Check
Yes
Yes
Yes
Description
Restrict serialization to privileged code.
Do not serialize sensitive data or else document it if you do. In the Logging Application
Block, the LogEntry object contains the logging information. Users who log sensitive information
should be aware that that the data is serialized, The following example shows
that the LogEntry class has a Serializable attribute.
[Serializable]
[InstrumentationClass(InstrumentationType.Event)]
public class LogEntry : ICloneable
Validate field data from serialized data streams.
Threading Checklist
Table 39 lists the threading recommendations.
Table 39: Threading Checklist
Check
Yes
Yes
Description
Stress test the application blocks to guarantee that they are not susceptible to denial
of service attacks. For example, the Caching Application Block’s background scheduler
that is used for scavenging and expiration was tested to ensure that its threads do not
deadlock or leak (this means that the threads are properly released), and that each
request does not generate a new thread.
Synchronize Dispose methods.
Reflection Checklist
Table 40 lists the reflection recommendations.
Table 40: Reflection Checklist
Check
Yes
Yes
Description
Callers cannot influence dynamically generated code (for example, by passing assembly
and type names as input arguments). It is possible to alter the configuration files to
dynamically generate code. Threat 2 in Building the Threat Models documents
this issue.
Use full assembly names when the .NET Framework’s Activator.CreateInstance method
creates an instance of the specified type.