Improving Web Application Security: Threats and - CGISecurity

202 Part III: Building Secure Web ApplicationsInterfaces and Link DemandsIf your class implements an interface and one of the method implementations has alink demand, make sure that the method declaration on the interface definition hasthe same link demand. Otherwise, the caller simply has to call your method throughthe interface to bypass the link demand. An example is shown below.public interface IMyInterface{// The link demand shown on the method implementation below// should be repeated herevoid Method1();}public class MyImplementation : IMyInterface{// The method implementation has a link demand but the interface does not[SecurityPermission(SecurityAction.LinkDemand,Flags=SecurityPermissionFlag.ControlPrincipal)]public void Method1(){}}With the following code, the caller is subject to the link demand:MyImplementation t = new MyImplementation();t.Method1();With the following code, the caller is not subject to the link demand:IMyInterface i = new MyImplementation();i.Method1();Structures and Link DemandsLink demands do not prevent the construction of structures by untrusted callers.This is because default constructors are not automatically generated for structures.Therefore, the structure level link demand only applies if you use an explicitconstructor.