R – Understanding CAS in the .NET framework

casnetSecurity

If I provide Evidence to the .net framework on which code group my assembly belongs to, couldn't I provide false evidence stating that I belong in the Trusted Zone code group?

I know what security policies are, permission sets but I don't understand how the framework checks the Evidence and then based on that evidence, determines the code group.

Any explanation would be appreciated.

Thanks 🙂

Best Answer

The evidence can be assembly strong name, code base and other stuff. It certainly can verify those stuff. You manually trust assemblies based on the evidence. Basically, you tell the framework if an assembly has the following properties, grant it that permission set. I don't see a way you could provide false evidence. Can you provide an example?

PS. Yes, you could, for example steal someone's key pair and sign your assembly with that. Like any other security system, it relies on a trust chain. If you break a part of the chain, you've screwed up. There's no real way you could circumvent these stuff in a security system. After all, you could compromise the system with a buffer overflow or something and add your assembly to the full trust list.

Related Solutions

C# – the difference between String and string in C#

string is an alias in C# for System.String.
So technically, there is no difference. It's like int vs. System.Int32.

As far as guidelines, it's generally recommended to use string any time you're referring to an object.

e.g.

string place = "world";

Likewise, I think it's generally recommended to use String if you need to refer specifically to the class.

e.g.

string greet = String.Format("Hello {0}!", place);

This is the style that Microsoft tends to use in their examples.

It appears that the guidance in this area may have changed, as StyleCop now enforces the use of the C# specific aliases.

C# – Calling the base constructor in C#

Modify your constructor to the following so that it calls the base class constructor properly:

public class MyExceptionClass : Exception
{
    public MyExceptionClass(string message, string extrainfo) : base(message)
    {
        //other stuff here
    }
}

Note that a constructor is not something that you can call anytime within a method. That's the reason you're getting errors in your call in the constructor body.

Best Answer

Related Solutions

C# – the difference between String and string in C#

This is the style that Microsoft tends to use in their examples.

C# – Calling the base constructor in C#

Related Topic