Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 245 To build a sandboxed wrapper assembly to write to the event log1. Create an assembly for your event log code. Configure the assembly version,strong name the assembly, and mark it with theAllowPartiallyTrustedCallersAttribute, as shown in the following example.[[assembly: AssemblyVersion("1.0.0.0")][assembly: AssemblyKeyFile(@"..\..\eventlogwrapper.snk")][assembly:AllowPartiallyTrustedCallersAttribute()]You must annotate any strong named assembly withAllowPartiallyTrustedCallersAttribute if you want to support partial-trustcallers. This suppresses an implicit link demand for full trust made by the .NETFramework whenever code from a strong named assembly is loaded and JITcompiled.Note AllowPartiallyTrustedCallersAttribute is defined in the System.Security namespace, soyou must reference this namespace with a using statement.2. Request appropriate permissions.Although not strictly necessary, requesting appropriate permissions is a goodpractice because it allows an administrator to view the assembly’s permissionrequirements by using tools like Permview.exe. Since the event log assembly canbe accessed from partial-trust callers, this assembly does not need to request a fulltrust permission set. The assembly in this example only writes to the event log ona specific machine and, therefore, only needs the following permission request:[assembly:EventLogPermissionAttribute(SecurityAction.RequestMinimum,MachineName="",PermissionAccess=EventLogPermissionAccess.Instrument)]However, if your assembly needs to request full trust, request the unrestrictedpermission set as follows:[assembly: PermissionSet(SecurityAction.RequestMinimum, Unrestricted=true)]