Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 617Is Your Class Design Secure?An assembly is only as secure as the classes and other types it contains. The followingquestions help you to review the security of your class designs:●●●●●●Do you limit type and member visibility?Review any type or member marked as public and check that it is an intendedpart of the public interface of your assembly.Are non-base classes sealed?If you do not intend a class to be derived from, use the sealed keyword to preventyour code from being misused by potentially malicious subclasses.For public base classes, you can use code access security inheritance demands tolimit the code that can inherit from the class. This is a good defense in depthmeasure.Do you use properties to expose fields?Check that your classes do not directly expose fields. Use properties to exposenon-private fields. This allows you to validate input values and apply additionalsecurity checks.Do you use read-only properties?Verify that you have made effective use of read-only properties. If a field is notdesigned to be set, implement a read-only property by providing a get accessoronly.Do you use virtual internal methods?These methods can be overridden from other assemblies that have access to yourclass. Use declarative checks or remove the virtual keyword if it is not arequirement.Do you implement IDisposable?If so, check that you call the Dispose method when you are finished with theobject instance to ensure that all resources are freed.Do You Create Threads?Multithreaded code is prone to subtle timing-related bugs or race conditions that canresult in security vulnerabilities. To locate multithreaded code, search source code forthe text “Thread” to identify where new Thread objects are created, as shown in thefollowing code fragment:Thread t = new Thread(new ThreadStart(someObject.SomeThreadStartMethod));