Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 229(continued)...Continued list of permissions...Notice that each permission is defined by an element, which definesthe permission type name, version, and whether or not it is in the unrestricted state.Permission State and Unrestricted PermissionsMany permissions include state, which is used to fine-tune the access rights specifiedby the permission. The state determines precisely what the permission allows yourapplication to do. For example, a FileIOPermission might specify a directory and anaccess type (read, write, and so on). The following permission demand requires thatcalling code is granted read permission to access the C:\SomeDir directory:(new FileIOPermission(FileIOPermissionAccess.Read, @"C:\SomeDir")).Demand();In its unrestricted state, the FileIOPermission allows any type of access to any areaon the file system (of course, operating system security still applies). The followingpermission demand requires that the calling code be granted the unrestrictedFileIOPermission:(new FileIOPermission(PermissionState.Unrestricted)).Demand();The ASP.NET Named Permission SetASP.NET policy files contain an “ASP.NET” named permission set. This defines theset of permissions that is granted by application domain policy to associatedapplications.