Improving Web Application Security: Threats and - CGISecurity

How To: Use Code Access Security Policy to Constrain an Assembly 825Summary of StepsThis How To includes the following steps:1. Create an assembly that performs file I/O.2. Create a Web application.3. Test file I/O with no code access security constraints.4. Configure code access security policy to constrain file I/O.5. Test file I/O with code access security constraints.Step 1. Create an Assembly That Performs File I/OIn this step, you create an assembly that performs file I/O using a supplied filename. To create a new assembly that performs file I/O1. Create a new Microsoft Visual C# development tool class library project calledFileIO and rename class1.cs to FileIO.cs.2. Add a strong name to the assembly.By adding a strong name, you make the assembly tamper proof by digitallysigning it. The public key component of the strong name also providescryptographically strong evidence for code access security policy. Anadministrator can apply policy by using the strong name to uniquely identifythe assembly.3. Use a fixed assembly version. Open Assemblyinfo.cs and set theAssemblyVersion attribute as shown below:[assembly: AssemblyVersion("1.0.0.1")]4. Add the following using statements to the top of FileIO.cs:using System.IO;using System.Text;5. Rename Class1 to FileWrapper and seal the class to prevent inheritance.public sealed class FileWrapper6. Rename the default constructor to match the class name and change it to private,which prevents instances of the FileWrapper class from being created. This classprovides static methods only.