Improving Web Application Security: Threats and - CGISecurity

Chapter 8: Code Access Security in Practice 207Configuring Code Access Security Policy to Restrict File I/OAn administrator can also configure code access security policy to restrict your code’sability to perform file I/O beyond your application’s virtual directory hierarchy.For example, the administrator can configure Enterprise or Machine level code accesssecurity policy to grant a restricted FileIOPermission to your assembly. This is mosteasily done if your assembly contains a strong name, because the administrator canuse this cryptographically strong evidence when configuring policy. For assembliesthat are not strong named, an alternative form of evidence needs to be used. For moreinformation about how to configure code access security to restrict the file I/Ocapability of an assembly, see “How To: Configure Code Access Security Policy toConstrain an Assembly, “ in the “How To” section of this guide.If your assembly is called by a Web application, a better approach is to configureASP.NET (application domain-level) code access security policy because you can use$AppDirUrl$ which represents the application’s virtual directory root. For moreinformation about restricting File I/O using ASP.NET code access security policy,see Chapter 9, “Using Code Access Security with ASP.NET.”Requesting FileIOPermissionTo help the administrator, if you know your assembly’s precise file I/O requirementsat build time (for example, you know directory names), declare your assembly’sFileIOPermission requirements by using a declarative permission request as shownin the following example.[assembly: FileIOPermission(SecurityAction.RequestMinimum, Read=@"C:\YourAppDir")]Event LogThe administration can see this attribute by using permview.exe. The additionaladvantage of using SecurityAction.RequestMinimum is that the assembly fails toload if it is not granted sufficient permissions. This is preferable to a runtime securityexception.To be able to access the event log, your assembly must be granted theEventLogPermission by code access security policy. If it is not, for example, becauseit is running within the context of a medium trust Web application, you need tosandbox your event logging code. For more information about sandboxing access tothe event log, see Chapter 9, “Using Code Access Security with ASP.NET.”