Improving Web Application Security: Threats and - CGISecurity

184 Part III: Building Secure Web ApplicationsPermissionsPermissions represent the rights for code to access a secured resource or perform aprivileged operation. The .NET Framework provides code access permissions and codeidentity permissions. Code access permissions encapsulate the ability to access aparticular resource or perform a privileged operation. Code identity permissions areused to restrict access to code, based on an aspect of the calling code’s identity suchas its strong name.Your code is granted permissions by code access security policy that is configured bythe administrator. An assembly can also affect the set of permissions that it isultimately granted by using permission requests. Together, code access securitypolicy and permission requests determine what your code can do. For example, codemust be granted the FileIOPermission to access the file system, and code must begranted the RegistryPermission to access the registry. For more information aboutpermission requests, see the “Requesting Permissions” section later in this chapter.Note Permission sets are used to group permissions together to ease administration.Restricted and Unrestricted PermissionsPermissions can be restricted or unrestricted. For example, in its unrestricted state, theFileIOPermission allows code to read or write to any part of the file system. In arestricted state, it might allow code to read files only from a specific directory.DemandsIf you use a class from the .NET Framework class library to access a resource orperform another privileged operation, the class issues a permission demand to ensurethat your code, and any code that calls your code, is authorized to access theresource. A permission demand causes the runtime to walk back up through the callstack (stack frame by stack frame), examining the permissions of each caller in thestack. If any caller is found not to have the required permission, a SecurityExceptionis thrown.Link DemandsA link demand does not perform a full stack walk and only checks the immediatecaller, one stack frame further back in the call stack. As a result, there are additionalsecurity risks associated with using link demands. You need to be particularlysensitive to luring attacks.Note With a luring attack, malicious code accesses the resources and operations that are exposedby your assembly, by calling your code through a trusted intermediary assembly.