Improving Web Application Security: Threats and - CGISecurity

190 Part III: Building Secure Web ApplicationsConsider the granted permissions based on the security policy shown in Figure 8.3.●●●●Any assembly originating from the My_Computer_Zone (any locally installedassembly), is granted the permissions defined by the FullTrust permission set.This is a built-in permission set defined when the .NET Framework is installedand represents the unrestricted set of all permissions.Assemblies authored by Company1 and originating from the intranet zone aregranted the permissions defined by the built-in LocalIntranet_Zone permissionset and the custom Comp1PSet permission set.Assemblies authored by Company2 are granted permissions defined by thecustom Comp2PSet permission set.Any assembly downloaded from a.b.c.com is granted permissions defined by thecustom ABCPSet permission set.Note If the membership condition for a particular code group is not satisfied, none of its childrenare evaluated.Exclusive and Level Final Code GroupsPolicy hierarchy processing and traversal can be fine-tuned using a couple ofattributes specified at the code group level, both of which can be set through the.NET Framework Configuration Tool. These are:● ExclusiveThis indicates that no other sibling code groups should be combined with thiscode group. You mark a code group as exclusive by selecting This policy levelwill only have the permissions from the permission set associated with thiscode group in the .NET Framework Configuration Tool.●Level FinalThis indicates that any lower level policies should be ignored. You mark a codegroup as Level Final by selecting Policy levels below this level will not beevaluated in the .NET Framework Configuration Tool. For example, if a matchingcode group in the machine policy is marked Level Final, policy settings from theuser policy file is ignored.Note The application domain level policy, for example, ASP.NET policy for server-side Webapplications, is always evaluated regardless of the level final setting.