Improving Web Application Security: Threats and - CGISecurity

626 Part V: Assessing Your SecuritySearch your code for the “.LinkDemand” string to identify where link demands areused. They can only be used declaratively. An example is shown in the followingcode fragment:[StrongNameIdentityPermission(SecurityAction.LinkDemand,PublicKey="00240000048...97e85d098615")]public static void SomeOperation() {}For more information about the issues raised in this section, see “Link Demands” inChapter 8, “Code Access Security in Practice.” The following questions help you toreview the use of link demands in your code:● Why are you using a link demand?A defensive approach is to avoid link demands as far as possible. Do not use themjust to improve performance and to eliminate full stack walks. Compared to thecosts of other Web application performance issues such as network latency anddatabase access, the cost of the stack walk is small. Link demands are only safeif you know and can limit which code can call your code.● Do you trust your callers?When you use a link demand, you rely on the caller to prevent a luring attack.Link demands are safe only if you know and can limit the exact set of direct callersinto your code, and you can trust those callers to authorize their callers.● Do you call code that is protected with link demands?If so, does your code provide authorization by demanding a security permissionfrom the callers of your code? Can the arguments passed to your methods passthrough to the code that you call? If so, can they maliciously influence the codeyou call?● Have you used link demands at the method and class level?When you add link demands to a method, it overrides the link demand on theclass. Check that the method also includes class-level link demands.● Do you use link demands on classes that are not sealed?Link demands are not inherited by derived types and are not used when anoverridden method is called on the derived type. If you override a method thatneeds to be protected with a link demand, apply the link demand to theoverridden method.● Do you use a link demand to protect a structure?Link demands do not prevent the construction of a structure by an untrustedcaller. This is because default constructors are not automatically generated forstructures, and therefore the structure level link demand only applies if you usean explicit constructor.