Improving Web Application Security: Threats and - CGISecurity

210 Part III: Building Secure Web Applications[SqlClientPermissionAttribute(SecurityAction.PermitOnly,AllowBlankPassword=false)]public static int CheckProductStockLevel(string productCode){// Retrieve the connection string from the registrystring connectionString = GetConnectionString();. . .}For more information about how to sandbox data access code to allow the OLE DBand other data providers to be used from partial trust Web applications, seeChapter 9, “Using Code Access Security with ASP.NET.”Directory ServicesCurrently, code that uses classes from the System.DirectoryServices namespace toaccess directory services such as Active Directory must be granted full trust.However, you can use the DirectoryServicesPermission to constrain the type ofaccess and the particular directory services to which code can connect.Constraining Directory Service AccessTo constrain code, you can use the DirectoryServicesPermissionAttribute togetherwith SecurityAction.PermitOnly. The following attribute ensures that the code canonly connect to a specific LDAP path and can only browse the directory.[DirectoryServicesPermissionAttribute(SecurityAction.PermitOnly,Path="LDAP://rootDSE",PermissionAccess=DirectoryServicesPermissionAccess.Browse)]public static string GetNamingContext(string ldapPath){DirectorySearcher dsSearcher = new DirectorySearcher(ldapPath);dsSearcher.PropertiesToLoad.Add("defaultNamingContext");dsSearcher.Filter = "";SearchResult result = dsSearcher.FindOne();return (string)result.Properties["adsPath"][0];}