Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 153
Check
Yes
Description
Specify an assembly’s file I/O requirements with declarative security attributes (this
should be SecurityAction.RequestMinimum). For example, the Caching Application
Block’s FileDependecy method calls the EnsureTargetFileAccessible method. This
method demands Read permission to access a file in case it is a protected resource.
The following code example demonstrates this.
[assembly : FileIOPermission(SecurityAction.RequestMinimum)]
In the Caching Application Block, the FileDependency class calls the
EnsureTargetFileAccessible method to demand I/O permission to read a
file.
public FileDependency(string fullFileName)
{
if (Object.Equals(fullFileName, null))
{
throw new ArgumentNullException("fullFileName",
SR.ExceptionNullFileName);
}
if (fullFileName.Length == 0)
{
throw new ArgumentOutOfRangeException("fullFileName",
SR.ExceptionEmptyFileName);
}
dependencyFileName = Path.GetFullPath(fullFileName);
EnsureTargetFileAccessible();
if (!File.Exists(dependencyFileName))
{
throw new ArgumentException(SR.ExceptionInvalidFileName,
"fullFileName");
}
}
this.lastModifiedTime =
File.GetLastWriteTime(fullFileName);
Yes
Yes
private void EnsureTargetFileAccessible()
{
FileIOPermission permission = new
FileIOPermission(FileIOPermissionAccess.Read,
dependencyFileName);
permission.Demand();
}
Use the EnvironmentPermission class to restrict code that accesses environment
variables. This is especially important if untrusted code can call the application block.
Declare environment permission requirements with declarative security attributes (use
SecurityAction.RequestMinimum).