Enterprise Library Test Guide - Willy .Net

246
Enterprise Library Test Guide
In general, threats can be classified as spoofing identity, tampering with data, repudiation,
information disclosure, denial of service, and elevation of privileges. To
learn more about these threats, see Threat Modeling Web Applications on MSDN in the
Microsoft patterns & practices Developer Center.
General Security Tests
All the application blocks are required to request code access security permissions for
the appropriate assemblies. Code access security allows code to be trusted to varying
degrees depending on where the code originates and on other aspects of the code’s
identity.
Test Case
The application blocks use reflection in multiple places to create domain objects. The
test case was to review the code in the AssemblyInfo file to determine whether the
application block requests permission to use reflection. This permission is necessary
for the application block to run in low-trust environments. (The AssemblyInfo file
contains information such as attributes, files, resources, types, versioning information,
and signing information for modifying an assembly’s metadata.)
Problem
The test case revealed that the ReflectionPermission class that controls access to
the metadata was not defined in the AssemblyInfo file. This class defines the set of
permissions that are required for application block assemblies to run in low-trust
environments.
When the application block runs in a low-trust environment, the system administrator
must explicitly grant those permissions that allow the application block to run.
The explicit permission to use reflection allows the ObjectBuilder subsystem to use
reflection and access private class members and metadata.
Solution
The solution was to add a ReflectionPermission object with the necessary permissions
to the AssemblyInfo file. The following code shows how to do this.
[assembly: ReflectionPermission(SecurityAction.RequestMinimum, MemberAccess =
true)]
Verification
Examining the AssemblyInfo file after applying the preceding code showed that it
included a ReflectionPermission object.