Improving Web Application Security: Threats and - CGISecurity

Chapter 8: Code Access Security in Practice 199Consider Protecting Cached DataIf you access a resource by using one of the .NET Framework classes, a permissiondemand appropriate for the resource type in question is issued by the class. If yousubsequently cache data for performance reasons, you should consider issuing anexplicit code access permission demand prior to accessing the cached data. Thisensures the calling code is authorized to access the specific type of resource. Forexample, if you read data from a file and then cache it, and you want to ensure thatcalling code is authorized, issue a FileIOPermission demand as shown in thefollowing example.// The following demand assumes the cached data was originally retrieved from// C:\SomeDir\SomeFile.datnew FileIOPermission(FileIOPermissionAccess.Read,@"C:\SomeDir\SomeFile.dat").Demand();// Now access the cache and return the data to the callerProtect Custom Resources with Custom PermissionsIf you expose a resource or operation by using unmanaged code, you should sandboxyour wrapper code and consider demanding a custom permission to authorize thecalling code.Full trust callers are granted the custom permission automatically as long as thepermission type implements the IUnrestrictedPermission interface. Partial trustcallers will not have the permission unless it has been specifically granted by codeaccess security policy. This ensures that non-trusted code cannot call your assemblyto access the custom resources that it exposes. Sandboxing also means that you arenot forced to grant the powerful UnmanagedCodePermission to any code that needsto call your code.For more information about calling unmanaged code, see the “Unmanaged Code”section later in this chapter. For an example implementation of a custom permission,see “How To: Create a Custom Encryption Permission” in the “How To” section ofthis guide.Link DemandsA link demand differs from a regular permission demand in that the run-timedemands permissions only from the immediate caller and does not perform a fullstack walk. Link demands are performed at JIT compilation time and can only bespecified declaratively.