Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 241Asserts Full TrustPartial-TrustWebApplicationWrapperAssembly(GAC)OLE DBDataSourceSandboxedFull-Trust CodeADO.NET OLE DBData Providerdemands Full TrustFigure 9.3Sandboxing OLE DB resource accessSandboxingIn this approach, you create a wrapper assembly to encapsulate OLE DB data sourceaccess. This assembly is granted full-trust permissions, which are required to use theADO.NET OLE DB managed provider. To build a sandboxed wrapper assembly to call OLE DB data sources1. Create an assembly for your data access code. Configure the assembly version,strong name the assembly, and mark it with theAllowPartiallyTrustedCallersAttribute, as follows:[assembly: AssemblyVersion("1.0.0.0")][assembly: AssemblyKeyFile(@"..\..\oledbwrapper.snk")][assembly:AllowPartiallyTrustedCallersAttribute()]You must annotate any strong named assembly withAllowPartiallyTrustedCallersAttribute if you want to support partial-trustcallers. This suppresses an implicit link demand for full trust made by the .NETFramework whenever code from a strong named assembly is loaded and JITcompiled.2. Request full trust. Although not strictly necessary, requesting full trust is a goodpractice because it allows an administrator to view the assembly’s permissionrequirements by using tools like Permview.exe. To request full trust, request theunrestricted permission set as follows:[assembly: PermissionSet(SecurityAction.RequestMinimum, Unrestricted=true)]