Improving Web Application Security: Threats and - CGISecurity

824 Improving Web Application Security: Threats and CountermeasuresBefore You BeginBefore you begin to use code access security policy to constrain an assembly, youshould be aware of the following:● To constrain a Web application so that it is only able to access files within its ownvirtual directory hierarchy, you can configure the application to run with mediumtrust by placing the following in Web.config:This uses ASP.NET code access security policy to constrain the ability of the Webapplication to perform file I/O and it also imposes other constraints. For example,a medium trust application cannot directly access the event log, registry, or OLEDB data sources.● ASP.NET code access security policy is configured independently from enterpriselevel,machine-level, and user-level code access security policy. The.NETFramework version 1.1 Configuration tool only supports enterprise-level,machine-level, and user-level policy.You must maintain ASP.NET policy by using a text or XML editor. For moreinformation about running Web applications using medium trust, see Chapter 9,“Using Code Access Security with ASP.NET.”● When you build an assembly, you can impose constraints programmatically usingcode access security. For more information about how to do this, see Chapter 8,“Code Access Security in Practice.”● You should generally avoid building Web applications that accept file names andpaths from the user because of the security risks posed by canonicalization issues.On occasion, you might need to accept a file name as input. This How To showsyou how you can constrain an assembly to ensure that it cannot access arbitraryparts of the file system. For more information about performing file I/O, see“File I/O” sections in Chapter 7, “Building Secure Assemblies” and Chapter 8,“Using Code Access Security in Practice,” of Improving Web Application Security.● For more information about code access security fundamentals, see Chapter 8,“Code Access Security in Practice,” of Improving Web Application Security.