Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 623The following questions help you to identify potentially vulnerable areas:● Is your assembly strong named?If it is, then default security policy ensures that it cannot be called by partiallytrusted callers. The Common Language Runtime (CLR) issues an implicit linkdemand for full trust. If your assembly is not strong named, it can be called by anycode unless you take explicit steps to limit the callers, for example by explicitlydemanding full trust.Note Strong named assemblies called by ASP.NET applications must be installed in the GlobalAssembly Cache.●●Do you use APTCA?If your strong named assembly contains AllowPartiallyTrustedCallersAttribute,partially trusted callers can call your code. In this situation, check that anyresource access or other privileged operation performed by your assembly isauthorized and protected with other code access security demands. If you use the.NET Framework class library to access resources, full stack walking demands areautomatically issued and will authorize calling code unless your code has used anAssert call to prevent the stack walk.Do you hand out object references?Check method returns and ref parameters to see where your code returns objectreferences. Check that your partial-trust code does not hand out references toobjects obtained from assemblies that require full-trust callers.Do You Restrict Access to Public Types and Members?You can use code access security identity demands to limit access to public types andmembers. This is a useful way of reducing the attack surface of your assembly.●●Do you restrict callers by using identity demands?If you have classes or structures that you only intend to be used within a specificapplication by specific assemblies, you can use an identity demand to limit therange of callers. For example, you can use a demand with aStrongNameIdentityPermission to restrict the caller to a specific set of assembliesthat have a have been signed with a private key that corresponds to the public keyin the demand.Do you use inheritance demands to restrict subclasses?If you know that only specific code should inherit from a base class, check that theclass uses an inheritance demand with a StrongNameIdentityPermission.