Improving Web Application Security: Threats and - CGISecurity

242 Part III: Building Secure Web Applications3. Wrap database calls with an Assert statement to assert full trust. Wrap a matchingRevertAssert call to reverse the effect of the assert. Although not strictly necessary,it is a good practice to place the call to RevertAssert in a finally block.Because the OLE DB provider demands full trust, the wrapper must assertfull-trust. Asserting an OleDbPermission is not sufficient. Step 7 explains howto improve the security of using CodeAccessPermission.Assert.public OleDbDataReader GetProductList(){try{// Assert full trust (the unrestricted permission set)new PermissionSet(PermissionState.Unrestricted).Assert();OleDbConnection conn = new OleDbConnection("Provider=SQLOLEDB; Data Source=(local);" +"Integrated Security=SSPI; Initial Catalog=Northwind");OleDbCommand cmd = new OleDbCommand("spRetrieveProducts", conn);cmd.CommandType = CommandType.StoredProcedure;conn.Open();OleDbDataReader reader =cmd.ExecuteReader(CommandBehavior.CloseConnection);return reader;}catch(OleDbException dbex){// Log and handle exception}catch(Exception ex){// Log and handle exception}finally{CodeAccessPermission.RevertAssert();}return null;}4. Build the assembly and install it in the GAC with the following command:gacutil -i oledbwrapper.dllTo ensure that the assembly is added to the GAC after each subsequent rebuild,add the following post build event command line (available from the project’sproperties in Visual Studio.NET) to your wrapper assembly project:"C:\Program Files\Microsoft Visual Studio .NET 2003\SDK\v1.1\Bin\gacutil.exe"/i $(TargetPath)