Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 155
Check
Yes
Yes
Description
Do not expose methods protected by a LinkDemand security check. Some method calls
in the .NET Framework are annotated with a LinkDemand. If they are called from within
an application block’s methods, the calling code is not checked for any security permissions.
An example of this is the Logging Application Block’s CollectIntrinsicProperties
method. This method calls the AppDomain.CurrentDomain property, which issues a link
demand to unmanaged code. Because of this, it is necessary to protect the CollectIntrinsicProperties
method with the SecurityPermissionFlag.UnmanagedCode enumeration.
[SecurityPermission(SecurityAction.Demand, Flags = SecurityPermission-
Flag.UnmanagedCode)]
private void CollectIntrinsicProperties()
{
this.TimeStamp = DateTime.UtcNow;
this.ActivityId = Trace.CorrelationManager.ActivityId;
try
{
MachineName = Environment.MachineName;
}
catch (Exception e)
{
this.MachineName =
String.Format(Properties.Resources.Culture,
Properties.Resources.IntrinsicPropertyError, e.Message);
}
try
{
//AppDomain.CurentDomain issues a link demand to
//unamanaged code. Link demands only check the immediate
//caller. (In this case, this is the
// CollectIntrinsicProperties method.)
appDomainName = AppDomain.CurrentDomain.FriendlyName;
None of the application block’s methods should include Assert statements or
LinkDemand security checks.