Re: Possible security error loading an Xsl?

From: Ed Murphy (Murphy_at_discussions.microsoft.com)
Date: 05/17/05


Date: Tue, 17 May 2005 07:40:11 -0700

Ah...thanks bunches. When I move the file to the local disk it works. Thanks
for the pointer! Got to make a note in the documentation for the program. :)

"Nicole Calinoiu" wrote:

> This doesn't seem to be related to CAS permissions at all. Instead, it
> would appear to be a consequence of how the zone is being evaluated for the
> specified path on Windows 2003. Only URIs for files in the internet and
> trusted sites zones result in the code path that includes Site.CreateFromUrl
> being evaluated. However, it would appear that a mapped drive path ends up
> being evaluated as falling in one of those zones on Windows 2003, but not
> on Windows XP. One obvious workaround for the problem would be to use a
> local copy of the XSL file.
>
> HTH,
> Nicole
>
>
> "Ed Murphy" <Ed Murphy@discussions.microsoft.com> wrote in message
> news:D25466C0-4402-4724-AD40-EF3A743C9D5D@microsoft.com...
> > Hi,
> >
> > I've run into a problem that may be security related that I haven't been
> > able to find a whole lot of information on and I'm hoping someone might
> > recognize it enough to give me some pointers.
> >
> > I've got the following code:
> >
> > XslTransform myTransform = new XslTransform();
> > myTransform.Load(@"M:\MyData\MyTransform.xsl");
> >
> > When the call to the Load routine executes, I get a system
> > ArgumentException with the description "Invalid Site".
> >
> > Here's the stack trace:
> > at System.Security.Util.SiteString.CreateSeparatedSite(String site)
> > at System.Security.Util.SiteString..ctor(String site)
> > at System.Security.Policy.Site.ParseSiteFromUrl(String name)
> > at System.Security.Policy.Site.CreateFromUrl(String url)
> > at System.Xml.XmlSecureResolver.CreateEvidenceForUrl(String
> > securityUrl)
> > at System.Xml.Xsl.XslTransform.Load(String url, XmlResolver resolver)
> > at System.Xml.Xsl.XslTransform.Load(String url)
> > ...
> >
> > I haven't been able to find much information on CreateSeparatedSite and
> > what I've been able to find on ParseSiteFromUrl doesn't really tell me
> > much. The XSL file is there and teh XSL code is correct (it's been used
> > in other instances with no problems.) This is the first time this code
> > has been tested on this particular laptop running Windows 2003 server,
> > but it's been run on that platform (and other) Windows boxes elsewhere
> > and not received this error.
> >
> > Could this be a system setting under security? In order to test this
> > code, I did have to create a FullTrust Runtime Security policy for the
> > URL file://M:/* under the .NET configuration for Runtime Security
> > Policy > Machine > Code Groups > All_Code. Might there be some other
> > entry I have to make?
> >
> > Got a headache from banging my head against this one, so any help is
> > MUCH appreciated.
> >
> > Regards,
> > Ed
>
>
>



Relevant Pages

  • [NT] Cumulative Security Update for Internet Explorer (MS04-025)
    ... Get your security news from a reliable source. ... * Microsoft Windows NT Workstation 4.0 Service Pack 6a ... Navigation Method Cross-Domain Vulnerability ...
    (Securiteam)
  • [NT] Vulnerability in HTML Help Allows Code Execution (MS05-001)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... * Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service ...
    (Securiteam)
  • Re: The Myth of the secure Mac
    ... OEM Windows XP Home goes for a bit under $100. ... >> secure than Home. ... Though this really has nothing to do with security. ... Microsoft counts on third-party developers to provide more ...
    (comp.sys.mac.advocacy)
  • SecurityFocus Microsoft Newsletter #120
    ... Strengthening Network Security: FREE Guide Network security is a ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft Windows File Protection Signed File Replacement... ... PlatinumFTPServer Information Disclosure Vulnerability ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter # 149
    ... MICROSOFT VULNERABILITY SUMMARY ... EveryBuddy Long Message Denial Of Service Vulnerability ... Intellitactics Network Security Manager ... Windows operating systems. ...
    (Focus-Microsoft)