Improving Web Application Security: Threats and - CGISecurity

618 Part V: Assessing Your SecurityThe following review questions help you to identify potential threadingvulnerabilities:● Does your code cache the results of a security check?Your code is particularly vulnerable to race conditions if it caches the results of asecurity check, for example in a static or global variable, and then uses the flag tomake subsequent security decisions.● Does your code impersonate?Is the thread that creates a new thread currently impersonating? The new threadalways assumes the process-level security context and not the security context ofthe existing thread.● Does your code contain static class constructors?Check static class constructors to check that they are not vulnerable if two or morethreads access them simultaneously. If necessary, synchronize the threads toprevent this condition.● Do you synchronize Dispose methods?If an object’s Dispose method is not synchronized, it is possible for two threads toexecute Dispose on the same object. This can present security issues, particularlyif the cleanup code releases unmanaged resource handlers such as file, process, orthread handles.Do You Use Serialization?Classes that support serialization are either marked with the SerializableAttribute orderive from ISerializable. To locate classes that support serialization, perform a textsearch for the “Serializable” string. Then, review your code for the following issues:● Does the class contain sensitive data?If so, check that the code prevents sensitive data from being serialized by markingthe sensitive data with the [NonSerialized] attribute by or implementingISerializable and then controlling which fields are serialized.If your classes need to serialize sensitive data, review how that data is protected.Consider encrypting the data first.● Does the class implement ISerializable?If so, does your class support only full trust callers, for example because it isinstalled in a strong named assembly that does not includeAllowPartiallyTrustedCallersAttribute? If your class supports partial-trustcallers, check that the GetObjectData method implementation authorizes thecalling code by using an appropriate permission demand. A good technique is touse a StrongNameIdentityPermission demand to restrict which assemblies canserialize your object.