Improving Web Application Security: Threats and - CGISecurity

How To: Use Code Access Security Policy to Constrain an Assembly 8297. Enter c:\temp in the File Path column and select Read and Path Disc(path discovery.)Path discovery permissions are required by the Path.GetFullPath function that isused by the FileIO assembly to canonicalize and validate the supplied filename.Read permissions are required by the File.OpenRead method, which is used bythe FileIO assembly to open the text file.8. Click OK.9. Select Security from the Available Permissions list and click Add.The FileIO assembly also needs the permission to execute in additionto the FileIOPermission. The permission to execute is represented bySecurityPermission with its Flags property set toSecurityPermissionFlag.Execution.10. Click Enable assembly execution, and then click OK.11. Click Finish to complete the creation of the permission set.You have now created a new permission set called RestrictedFileIO that containsa restricted FileIOPermission, which allows read and path discovery to theC:\Temp directory, and a restricted SecurityPermission, which allows assemblyexecution. To create a new code group1. Expand Code Groups, and then expand All_Code.2. Right-click All_Code, and then click New.3. Enter FileIOAssembly as the code group name, and then click Next.4. Select StrongName from the Choose the condition type for this code groupdrop-down list.You use this code group to apply specific permissions as defined by theRestrictedFileIO permission set to the FileIO assembly. A strong name providescryptographically strong evidence to uniquely identify an assembly.5. To specify the FileIO assembly’s public key, (which it has because it contains astrong name), click Import, and then browse to the project output folder thatcontains FileIO.dll. Click Open to extract the public key from the assembly.6. Click Next, and then select RestrictedFileIO from the Use existing permission setdrop-down list.7. Click Next and then Finish to complete the creation of the code group.You have now created a new code group that applies the permissions defined bythe RestrictedFileIO permission set to the FileIO assembly.8. In the right window, select the FileIOAssembly code group, and then click EditCode Group Properties.