Improving Web Application Security: Threats and - CGISecurity

170 Part III: Building Secure Web ApplicationsIf your assembly supports partial trust callers, consider the additional threat of beingpassed a delegate by malicious code. For risk mitigation techniques to address thisthreat, see the “Delegates” section in Chapter 8, “Code Access Security in Practice.”SerializationYou may need to add serialization support to a class if you need to be able to marshalit by value across a .NET remoting boundary (that is, across application domains,processes, or computers) or if you want to be able to persist the object state to create aflat data stream, perhaps for storage on the file system.By default, classes cannot be serialized. A class can be serialized if it is marked withthe SerializableAttribute or if it derives from ISerializable. If you use serialization:●●Do not serialize sensitive data.Validate serialized data streams.Do Not Serialize Sensitive DataIdeally, if your class contains sensitive data, do not support serialization. If you mustbe able to serialize your class and it contains sensitive data, avoid serializing thefields that contain the sensitive data. To do this, either implement ISerializable tocontrol the serialization behavior or decorate fields that contain sensitive data withthe [NonSerialized] attribute. By default, all private and public fields are serialized.The following example shows how to use the [NonSerialized] attribute to ensure aspecific field that contains sensitive data cannot be serialized.[Serializable]public class Employee {// OK for name to be serializedprivate string name;// Prevent salary being serialized[NonSerialized] private double annualSalary;. . .}Alternatively, implement the ISerializable interface and explicitly control theserialization process. If you must serialize the sensitive item or items of data, considerencrypting the data first. The code that de-serializes your object must have access tothe decryption key.Validate Serialized Data StreamsWhen you create an object instance from a serialized data stream, do not assume thestream contains valid data. To avoid potentially damaging data being injected intothe object, validate each field as it is reconstituted as shown in the following codesample.