Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 627●Do you use explicit interfaces?Search for the Interface keyword to find out. If so, check if the methodimplementations are marked with link demands. If they are, check that theinterface definitions contain the same link demands. Otherwise, it is possible for acaller to bypass the link demand.Do You Use Potentially Dangerous Permissions?Check that the following permission types are only granted to highly trusted code.Most of them do not have their own dedicated permission type, but use the genericSecurityPermission type. You should closely scrutinize code that uses these types toensure that the risk is minimized. Also, you must have a very good reason to usethese permissions.Table 21.3 Dangerous PermissionsPermissionSecurityPermission.UnmanagedCodeSecurityPermission.SkipVerificationSecurityPermission.ControlEvidenceSecurityPermission.ControlPolicySecurityPermission.SerializationFormatterSecurityPermission.ControlPrincipalReflectionPermission.MemberAccessSecurityPermission.ControlAppDomainSecurityPermission.ControlDomainPolicyDescriptionCode can call unmanaged code.The code in the assembly no longer has to be verifiedas type safe.The code can provide its own evidence for use bysecurity policy evaluation.Code can view and alter policy.Code can use serialization.Code can manipulate the principal object used forauthorization.Code can invoke private members of a type throughreflection.Code can create new application domains.Code can change domain policy.Do You Compile With the /unsafe Option?Use Visual Studio .NET to check the project properties to see whether Allow UnsafeCode Blocks is set to true. This sets the /unsafe compiler flag, which tells thecompiler that the code contains unsafe blocks and requests that a minimumSkipVerification permission is placed in the assembly.If you compiled with /unsafe, review why you need to do so. If the reason islegitimate, take extra care to review the source code for potential vulnerabilities.