Improving Web Application Security: Threats and - CGISecurity

628 Part V: Assessing Your SecurityUnmanaged CodeGive special attention to code that calls unmanaged code, including Win32 DLLs andCOM objects, due to the increased security risk. Unmanaged code is not verifiablytype safe and introduces the potential for buffer overflows. Resource access fromunmanaged code is not subject to code access security checks. This is theresponsibility of the managed wrapper class.Generally, you should not directly expose unmanaged code to partially trustedcallers. For more information about the issues raised in this section, see the“Unmanaged Code” sections in Chapter 7, “Building Secure Assemblies,” andChapter 8, “Code Access Security in Practice.”Use the following review questions to validate your use of unmanaged code:●Do you assert the unmanaged code permission?If so, check that your code demands an appropriate permission prior to callingthe Assert method to ensure that all callers are authorized to access the resourceor operation exposed by the unmanaged code. For example, the following codefragment shows how to demand a custom Encryption permission and then assertthe unmanaged code permission:// Demand custom EncryptionPermission.(new EncryptionPermission(EncryptionPermissionFlag.Encrypt, storeFlag)).Demand();// Assert the unmanaged code permission.(new SecurityPermission(SecurityPermissionFlag.UnmanagedCode)).Assert();// Now use P/Invoke to call the unmanaged DPAPI functions.●For more information see “Assert and RevertAssert” in Chapter 8, “Code AccessSecurity in Practice.”Do you use SuppressUnmanagedCodeAttribute?This attribute suppresses the demand for the unmanaged code permission issuedautomatically when managed code calls unmanaged code. If P/Invoke methods orCOM interop interfaces are annotated with this attribute, ensure that all codepaths leading to the unmanaged code calls are protected with security permissiondemands to authorize callers. Also check that this attribute is used at the methodlevel and not at the class level.Note Adding a SupressUnmanagedCodeSecurityAttribute turns the implicit demand for theUnmanagedCode permission issued by the interop layer into a LinkDemand. Your code isvulnerable to luring attacks.