Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 625●Do you reduce the assert duration?Check that you only assert a permission for the minimum required length of time.For example, if you need to use an Assert call just while you call another method,check that you make a call to RevertAssert immediately after the method call.Do You Use Permission Demands When You Should?Your code is always subject to permission demand checks from the .NET Frameworkclass library, but if your code uses explicit permission demands, check that this isdone appropriately. Search your code for the “.Demand” string to identity declarativeand imperative permission demands, and then review the following questions:●●●●Do you cache data?If so, check whether or not the code issues an appropriate permission demandprior to accessing the cached data. For example, if the data is obtained from a file,and you want to ensure that the calling code is authorized to access the file fromwhere you populated the cache, demand a FileIOPermission prior to accessingthe cached data.Do you expose custom resources or privileged operations?If your code exposes a custom resource or privileged operation throughunmanaged code, check that it issues an appropriate permission demand, whichmight be a built-in permission type or a custom permission type depending onthe nature of the resource.Do you demand soon enough?Check that you issue a permission demand prior to accessing the resource orperforming the privileged operation. Do not access the resource and thenauthorize the caller.Do you issue redundant demands?Code that uses the .NET Framework class libraries is subject to permissiondemands. Your code does not need to issue the same demand. This results ina duplicated and wasteful stack walk.Do You Use Link Demands?Link demands, unlike regular demands, only check the immediate caller. They do notperform a full stack walk, and as a result, code that uses link demands is subject toluring attacks. For information on Luring Attacks, see “Link Demands” in Chapter 8,“Code Access Security in Practice.”