Improving Web Application Security: Threats and - CGISecurity

236 Part III: Building Secure Web ApplicationsSandbox Privileged CodeAnother approach that does not require an update to ASP.NET code access securitypolicy is wrapping your resource access code in its own wrapper assembly andconfiguring machine-level code access security policy to grant the specific assemblythe appropriate permission. Then you can sandbox the higher-privileged code usingthe CodeAccessPermission.Assert method so you do not have to change the overallpermission grant of the Web application. The Assert method prevents the securitydemand issued by the resource access code from propagating back up the call stackbeyond the boundaries of the wrapper assembly.A Sandboxing PatternYou can apply the following pattern to any privileged code that needs to access arestricted resource or perform another privileged operation for which the parent Webapplication does not have sufficient permissions:1. Encapsulate the resource access code in a wrapper assembly.Make sure the assembly is strong named so that it can be installed in the GAC.2. Assert the relevant permission prior to accessing the resource.This means that the caller must have the assertion security permission(SecurityPermission with SecurityPermissionFlag.Assertion). Applicationsconfigured for Medium or higher trust levels have this permission.Asserting permissions is a dangerous thing to do because it means that the codethat calls your code can access the resource that is encapsulated by your assemblywithout requiring the relevant resource access permission. The Assert statementsays that your code can vouch for the legitimacy of its callers. To do this, yourcode should demand an alternate permission so that it can authorize the callingcode prior to calling Assert. In this way, you only allow code that has beengranted the alternate permission to access the resource that your assemblyexposes.The .NET Framework might not provide a suitable permission to demand. In thiscase, you can create and demand a custom permission. For more informationabout how to create a custom permission, see “How To: Create a CustomEncryption Permission” in the “How To” section of this guide.3. Annotate the wrapper assembly with APTCA.This allows the partial-trust Web application to call the assembly.