Improving Web Application Security: Threats and - CGISecurity

Chapter 7: Building Secure Assemblies 173●●●If you dynamically load assemblies, for example, by usingSystem.Reflection.Assembly.Load, do not use assembly or type names passed toyou from untrusted sources.If your assemblies dynamically generate code to perform operations for a caller,make sure the caller is in no way able to influence the code that is generated. Thisissue is more significant if the caller operates at a lower trust level than theassembly that generates code.If your code generation relies on input from the caller, be especially vigilant forsecurity vulnerabilities. Validate any input string used as a string literal in yourgenerated code and escape quotation mark characters to make sure the callercannot break out of the literal and inject code. In general, if there is a way that thecaller can influence the code generation such that it fails to compile, there isprobable security vulnerability.For more information, see “Secure Coding Guidelines for the .NET Framework“ inthe MSDN Library.ObfuscationIf you are concerned with protecting intellectual property, you can make it extremelydifficult for a decompiler to be used on the MSIL code of your assemblies, by usingan obfuscation tool. An obfuscation tool confuses human interpretation of the MSILinstructions and helps prevent successful decompilation.Obfuscation is not foolproof and you should not build security solutions that rely onit. However, obfuscation does address threats that occur because of the ability toreverse engineer code. Obfuscation tools generally provide the following benefits:● They help protect your intellectual property.● They obscure code paths. This makes it harder for an attacker to crack securitylogic.● They mangle the names of internal member variables. This makes it harder tounderstand the code.● They encrypt strings. Attackers often attempt to search for specific strings to locatekey sensitive logic. String encryption makes this much harder to do.A number of third-party obfuscation tools exist for the .NET Framework. One tool,the Community Edition of the Dotfuscator tool by PreEmptive Solutions, is includedwith the Microsoft Visual Studio ® .NET 2003 development system. It is also availablefrom http://www.preemptive.com/dotfuscator. For more information, see the list ofobfuscator tools listed at http://www.gotdotnet.com/team/csharp/tools/default.aspx.