Improving Web Application Security: Threats and - CGISecurity

Chapter 8: Code Access Security in Practice 211Requesting DirectoryServicesPermissionTo document the permission requirements of your code, and to ensure your assemblycannot load if it is granted insufficient directory services access from code accesssecurity policy, add an assembly level DirectoryServicesPermissionAttribute withSecurityAction.RequestMinimum as shown in the following example.[assembly: DirectoryServicesPermissionAttribute(SecurityAction.RequestMinimum,Path="LDAP://rootDSE",PermissionAccess=DirectoryServicesPermissionAccess.Browse)]Environment VariablesCode that needs to read or write environment variables using theSystem.Environment class must be granted the EnvironmentPermission by codeaccess security policy. This permission type can be used to constrain access to specificnamed environment variables.Constraining Environment Variable AccessTo constrain code so that it can only read specific environment variables, you can usethe EnvironmentPermissionAttribute together with SecurityAction.PermitOnly.The following attributes ensure that the code can only read from the username,userdomain, and temp variables.[EnvironmentPermissionAttribute(SecurityAction.PermitOnly, Read="username")][EnvironmentPermissionAttribute(SecurityAction.PermitOnly, Read="userdomain")][EnvironmentPermissionAttribute(SecurityAction.PermitOnly, Read="temp")]public static string GetVariable(string name){return Environment.GetEnvironmentVariable(name);}Requesting EnvironmentPermissionTo document the permission requirements of your code, and to ensure your assemblycannot load if it is granted insufficient environment variable access from code accesssecurity policy, add an assembly level EnvironmentPermissionAttribute withSecurityAction.RequestMinimum as shown in the following code.[assembly: EnvironmentPermissionAttribute(SecurityAction.RequestMinimum,Read="username"),EnvironmentPermissionAttribute(SecurityAction.RequestMinimum,Read="userdomain"),EnvironmentPermissionAttribute(SecurityAction.RequestMinimum,Read="temp")]