Improving Web Application Security: Threats and - CGISecurity

828 Improving Web Application Security: Threats and CountermeasuresStep 4. Configure Code Access Security Policy toConstrain File I/OIn this step, you configure code access security policy for the FileIO assemblyand grant it a restricted FileIOPermission so that it is only able to access filesfrom beneath C:\Temp. You start by creating a new permission set that includesa restricted FileIOPermission. You then create a new code group to associate thenew permission set with the FileIO assembly by using strong name evidence. To create a new permission set1. Start the .NET Framework version 1.1 Configuration tool from the AdministrativeTools program folder.2. Expand the Runtime Security Policy node.Three levels of code access security policy are displayed: Enterprise, Machine, andUser. The fourth level at which you can configure code access security policy is theapplication domain level. ASP.NET implements application domain level policy,but this is not maintained using the.NET Framework version 1.1 Configurationtool. To edit ASP.NET policy, you must use a text editor.For more information about ASP.NET policy and how to use it, see Chapter 9,“Using Code Access Security with ASP.NET.”3. Expand the Machine node.The Code Groups and Permission Sets folders are displayed. Each policy filecontains a hierarchical collection of code groups. Code groups are used to assignpermissions to assemblies. A code group consists of two elements:● A membership condition — This is based on evidence, for example anassembly’s strong name.● A permission set — The permissions that the permission set contains aregranted to assemblies whose evidence matches the membership condition.A permission set is a grouping that contains a collection of individual code accesssecurity permissions. Individual permissions represent the rights for code toaccess specific resource types or perform specific types of privileged operations.4. Right-click Permission Sets, and then click New.5. Enter RestictedFileIO in the Name field, and then click Next.6. Select FileIO from the Available Permissions list, and then click Add.