Re: Adjusting security setting to run an embedded windows control in IE

From: Marina (someone_at_nospam.com)
Date: 01/28/04 

Date: Wed, 28 Jan 2004 10:57:17 -0500

This assembly is not a strongly named one, so I don't think option 2 would
work.

How does one go about giving an AppDomain full trust by using a URL
membership condition?

Thanks

"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com> wrote
in message news:OUVp7Zb5DHA.2764@TK2MSFTNGP09.phx.gbl...
> The best way to do this is to give just the assemblies that need Full
Trust
> that permission.
>
> The reason it doesn't work in your situation is that when IE creates the
> AppDomain that it runs your code in, that AppDomain is created based on
the
> URL which will have some sort of partial trust (unless that URL or the
whole
> zone has been given Full Trust).
>
> Two things happen after that:
> - If your assembly is not marked with the
> AllowPartiallyTrustedCallersAttribute, the partially trusted AppDomain
that
> it is running in will not be able to call it.
> - Any code that requires a permission will hit your assembly, where it
will
> be granted due to your Full Trust, but will likely fail when the stack
gets
> up to the partially trusted AppDomain since the AppDomain may not have
that
> permission.
>
> You have basically two options to solve this:
> - Make the AppDomain have Full Trust with something like a URL membership
> condition. This is the easiest thing to do, but is not very secure,
> especially if the URL is not very specific.
> - Add the AllowPartiallyTrustedCallersAttribute and use Assert on the
> Permissions that you need when you need them to prevent the stack walk
into
> the containing AppDomain. This is more work, but is vastly more secure
and
> is the recommended approach.
>
> There have been some good articles on implementing the second approach. I
> believe Ivan Medvedev has some good info on his website. You might start
> there:
> http://www.dotnetthis.com/Articles/WritingForSEE.htm
>
> Joe K.
>
> "Marina" <someone@nospam.com> wrote in message
> news:Os5oCLb5DHA.2572@TK2MSFTNGP09.phx.gbl...
> > Hi,
> >
> > I am trying to find the minimum security settings to allow a windows
> control
> > embedded in IE have full trust.
> >
> > If I give the entire Intranet zone full trust, this works. However, this
> is
> > very broad and gives the entire zone high privleges.
> >
> > I tried giving just the assembly full trust (using the full URL for the
> > DLL), but this doesn't seem to work.
> >
> > Any direction in how to accomplish this?
> >
> >
>
>

Relevant Pages

  • Re: security/strong name/zones clarification needed
    ... this AppDomain needs to be setup before your assembly can be loaded, ... Now your assembly is executing with the FullTrust permission set. ... When the call stack is initiated, ... All my assemblies are strong named. ...
    (microsoft.public.dotnet.security)
  • Re: security/strong name/zones clarification needed
    ... Does the Assert code go in its ... >>this AppDomain needs to be setup before your assembly can ... >>will recieve the permission grant you expect (in this ... All my assemblies are strong named. ...
    (microsoft.public.dotnet.security)
  • Re: security/strong name/zones clarification needed
    ... Does the Assert code go in its ... >this AppDomain needs to be setup before your assembly can ... >will recieve the permission grant you expect (in this ... All my assemblies are strong named. ...
    (microsoft.public.dotnet.security)
  • Re: security/strong name/zones clarification needed
    ... Dim zz As New System.Security.PermissionSet ... >> When assemblies are ... >>>needs to host the CLR, it creates an AppDomain, but due ... >>>will recieve the permission grant you expect (in this ...
    (microsoft.public.dotnet.security)
  • RE: How to provide extra trust using strong name for an Internet Explorer hosted UserControl
    ... AppDomains have permission grants assigned to them. ... It prevents an AppDomain that is being hosted in an untrusted place from allowing FullTrust code to do bad ... Assemblies must be loaded into an AppDomain. ... Produced By Microsoft MimeOLE V6.00.3790.0 ...
    (microsoft.public.dotnet.security)