Improving Web Application Security: Threats and - CGISecurity

230 Part III: Building Secure Web ApplicationsASP.NET policy also introduces a custom AspNetHostingPermission, which has anassociated Level attribute that corresponds to one of the default levels. All publictypes in the System.Web and System.Web.Mobile are protected with demands forthe Minimum level of this permission. This risk mitigation strategy is designed toensure that Web application code cannot be used in other partial-trust environmentswithout specific policy configuration by an administrator.Substitution ParametersIf you edit one of the ASP.NET policy files, you will notice that some of thepermission elements contain substitution parameters ($AppDirUrl$, $CodeGen$, and$Gac$). These parameters allow you to configure permissions to assemblies that arepart of your Web application, but are loaded from different locations. Eachsubstitution parameter is replaced with an actual value at security policy evaluationtime, which occurs when your Web application assembly is loaded for the first time.Your Web application might consist of the following three assembly types:● Private assemblies that are compiled at build time and deployed in theapplication’s bin directoryImportant This type of assembly cannot be strong named. Strong named assemblies used byASP.NET Web applications must be installed in the global assembly cache. This restriction isnecessary because of the internal workings of the multi-application domain worker process.●●Dynamically compiled assemblies that are generated in response to a page requestShared assemblies that are loaded from the computer’s global assembly cacheEach of these assembly types has an associated substitution parameter, whichTable 9.2 summarizes.Table 9.2 ASP.NET Code Access Security Policy Substitution ParametersParameter$AppDirUrl$RepresentsThe application’s virtual root directory. This allows permissions to be applied tocode that is located in the application’s bin directory.For example, if a virtual directory is mapped to C:\YourWebApp, then$AppDirUrl$ would equate to C:\YourWebApp.$CodeGen$The directory that contains dynamically generated assemblies (for example, theresult of .aspx page compiles). This can be configured on a per application basisand defaults to %windir%\Microsoft.NET\Framework\{version}\TemporaryASP.NET Files.$CodeGen$ allows permissions to be applied to dynamically generatedassemblies.$Gac$Any assembly that is installed in the computer’s global assembly cache (GAC)(%windir%\assembly). This allows permissions to be granted to strong namedassemblies loaded from the GAC by the Web application.