Improving Web Application Security: Threats and - CGISecurity

240 Part III: Building Secure Web ApplicationsMedium Trust RestrictionsIf your application runs at medium trust, it faces a number of restrictions, the mostsignificant of which are:● It cannot directly access the event log.● It has restricted file system access and can only access files in the application’svirtual directory hierarchy.● It cannot directly access OLE DB data sources (although medium trustapplications are granted the SqlClientPermission, which allows them to accessSQL Server).● It has limited access to Web services.● It cannot directly access the Windows registry.This section shows you how to access the following resource types from a mediumtrustWeb application or Web service:● OLE DB● Event log● Web services● RegistryOLE DBMedium-trust Web applications are not granted the OleDbPermission. Furthermore,the OLE DB .NET data provider currently demands full-trust callers. If you have anapplication that needs to access OLE DB data sources while running at medium trust,use the sandboxing approach. Place your data access code in a separate assembly,strong name it, and install it in the GAC, which gives it full trust.Note Modifying policy does not work unless you set the trust level to “Full” because the OLE DBmanaged provider demands full trust.Figure 9.3 shows the arrangement.