Improving Web Application Security: Threats and - CGISecurity

152 Part III: Building Secure Web ApplicationsSupporting Partial Trust CallersThe risk of a security compromise increases significantly if your assembly supportspartial trust callers (that is, code that you do not fully trust.) Code access security hasadditional safeguards to help mitigate the risk. For additional guidelines that applyto assemblies that support partial trust callers, see Chapter 8, “Code Access Securityin Practice.” Without additional programming, your code supports partial trustcallers in the following two situations:● Your assembly does not have a strong name.● Your assembly has a strong name and includes theAllowPartiallyTrustedCallersAttribute (APTCA) assembly level attribute.Why Worry About the Target Environment?The trust environment that your assembly runs in is important for the followingreasons:● A partial trust assembly can only gain access to a restricted set of resources andperform a restricted set of operations, depending upon which code access securitypermissions it is granted by code access security policy.● A partial trust assembly cannot call a strong named assembly unless it includesAllowPartiallyTrustedCallersAttribute.●Other partial trust assemblies may not be able to call your assembly because theydo not have the necessary permissions. The permissions that a calling assemblymust be able to call your assembly are determined by:● The types of resources your assembly accesses● The types of privileged operation your assembly performsSandbox Highly Privileged CodeTo avoid granting powerful permissions to a whole application just to satisfy theneeds of a few methods that perform privileged operations, sandbox privileged codeand put it in a separate assembly. This allows an administrator to configure codeaccess security policy to grant the extended permissions to the code in the specificassembly and not to the whole application.For example, if your application needs to call unmanaged code, sandbox theunmanaged calls in a wrapper assembly, so that an administrator can grant theUnmanagedCodePermission to the wrapper assembly and not the wholeapplication.Note Sandboxing entails using a separate assembly and asserting security permissions to preventfull stack walks.