Click here to Skip to main content
15,888,113 members
Home / Discussions / C#
   

C#

 
GeneralRe: Help for code Pin
Eddy Vluggen4-Mar-11 12:16
professionalEddy Vluggen4-Mar-11 12:16 
GeneralRe: Help for code Pin
Girish4815-Mar-11 16:56
Girish4815-Mar-11 16:56 
GeneralRe: Help for code Pin
Eddy Vluggen6-Mar-11 0:42
professionalEddy Vluggen6-Mar-11 0:42 
QuestionHow do you protect your app hosting third party dll ...? [modified] Pin
devvvy2-Mar-11 21:32
devvvy2-Mar-11 21:32 
AnswerRe: How do you protect your app hosting third party dll ...? Pin
Eddy Vluggen3-Mar-11 6:58
professionalEddy Vluggen3-Mar-11 6:58 
GeneralRe: How do you protect your app hosting third party dll ...? Pin
devvvy3-Mar-11 15:21
devvvy3-Mar-11 15:21 
GeneralRe: How do you protect your app hosting third party dll ...? Pin
Eddy Vluggen4-Mar-11 11:04
professionalEddy Vluggen4-Mar-11 11:04 
GeneralRe: How do you protect your app hosting third party dll ...? [modified] Pin
devvvy4-Mar-11 22:28
devvvy4-Mar-11 22:28 
Hello I tried out your advice - MSDN article on sand boxing third party dll [^]

The following code created new AppDomain for third party dll, invoke it and found out that AppDomain.Current.GetData[KEY1] refers to that of the "New Domain" (not old AppDomain of hosting app)

But again, two problems still remains:
a. third party can still access all AppDomain - see this.[^]
(But if MSDN is correct, GetCallingAssembly requires ReflectionPermission as well - so DENY ReflectionPermission is very key)[^]

b. third party library can simply retrieves hosting types by GetCallingAssembly
<br />
public void DoWork(string Message)<br />
        {<br />
            // For some reason keeps getting "Exception of type 'System.ExecutionEngineException' was thrown." when there're more than one class other than "Program.cs" but this worked otherwise (i.e. I think my DENY ReflectionPermission didn't work!) ...<br />
            Type[] Types = Assembly.GetCallingAssembly().GetTypes();<br />
            if (Types != null)<br />
            {<br />
                foreach (Type t in Types)<br />
                {<br />
                    Console.WriteLine("Detected type: " + t.FullName);<br />
                }<br />
            }<br />


c. Am I doing it right below on how to DENY ReflectionPermission? (By setting PermissionState.None)

Anyway here's my full test code.
<br />
***** Program.cs *****<br />
using System;<br />
using System.IO;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
using System.Threading;<br />
<br />
using System.Reflection;<br />
using System.Security;<br />
using System.Security.Policy;<br />
using System.Security.Permissions;<br />
<br />
using UserUtil;<br />
using SimpleUtil;<br />
<br />
namespace TestAppDomain<br />
{<br />
    class Program <br />
    {<br />
        public const string KEY1 = "KEY1";<br />
        public static AppDomain UserDomain = null;<br />
<br />
        static void Main(string[] args)<br />
        {<br />
            string UntrustedThirdPartyDir = @"..\..\UserUtil\UserUtil\bin\Debug";<br />
            string ThirdPartyDll = "UserUtil.dll";<br />
            string ThirdPartyServiceFullyQualifiedName = "UserUtil.ServiceProvider";<br />
<br />
            Assembly UserAssembly = null;<br />
<br />
            Object oProvider = null;<br />
            SimpleUtil.IServiceProvider UserProvider = null;<br />
<br />
            try<br />
            {<br />
                #region Sandbox preparation<br />
                // http://msdn.microsoft.com/en-us/library/bb763046.aspx<br />
                // http://www1.cs.columbia.edu/~lok/csharp/refdocs/System.Security.Permissions/types/ReflectionPermission.html<br />
                // http://www1.cs.columbia.edu/~lok/csharp/refdocs/System.Security.Permissions/types/ReflectionPermissionFlag.html<br />
                AppDomainSetup AdSetup = new AppDomainSetup();<br />
                AdSetup.ApplicationBase = Path.GetFullPath(UntrustedThirdPartyDir);<br />
<br />
                PermissionSet PermSet = new PermissionSet(PermissionState.None);<br />
                PermSet.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));<br />
<br />
                // QUESTION: How to DENY reflection permission...? Am I doing it right? (I don't think it is)<br />
                ReflectionPermission RefPerm = new ReflectionPermission(PermissionState.None);<br />
                PermSet.AddPermission(RefPerm);<br />
<br />
                StrongName FullTrustAssembly = typeof(Program).Assembly.Evidence.GetHostEvidence<StrongName>();<br />
                #endregion<br />
<br />
<br />
                UserDomain = AppDomain.CreateDomain(<br />
                    "UserDomain", null, AdSetup, PermSet, FullTrustAssembly<br />
                    );<br />
<br />
                AppDomain.CurrentDomain.SetData(KEY1, "PrivateKey");<br />
                UserDomain.SetData(KEY1, "NoProblem!");<br />
<br />
                oProvider = Activator.CreateInstanceFrom(<br />
                    UserDomain, ThirdPartyDll, ThirdPartyServiceFullyQualifiedName<br />
                ).Unwrap();<br />
<br />
                #region No need for this...<br />
                // oProvider = UserDomain.CreateInstanceFrom("UserUtil.dll", "UserUtil.ServiceProvider").Unwrap();<br />
                #endregion<br />
<br />
                #region No need for this either ..<br />
                // UserAssembly = Assembly.LoadFrom("UserUtil.dll");<br />
                // oProvider = UserAssembly.CreateInstance("UserUtil.ServiceProvider");<br />
                #endregion<br />
<br />
                if (oProvider != null)<br />
                {<br />
                    if (oProvider is SimpleUtil.IServiceProvider)<br />
                    {<br />
                        UserProvider = (SimpleUtil.IServiceProvider)oProvider;<br />
<br />
                        Object[] parameters = { "Calling UserProvider.DoWork" };<br />
<br />
                        while (true)<br />
                        {<br />
                            #region OPTION 1: prints out "UserUtil.DoWork - secret=NoProblem!"<br />
                            // UserProvider.DoWork("Calling UserProvider.DoWork");<br />
                            #endregion<br />
<br />
                            #region OPTION 2: prints out "UserUtil.DoWork - secret=NoProblem!"<br />
                            UserProvider.GetType().GetMethod("DoWork").Invoke(UserProvider, parameters);<br />
                            #endregion<br />
                        }<br />
                    }<br />
                }<br />
            }<br />
            catch (Exception Ex)<br />
            {<br />
                Console.WriteLine(Ex.Message);<br />
            }<br />
<br />
            return;<br />
        }<br />
    }<br />
}<br />
<br />
*** SimpleUtil.ServiceProvider ***<br />
using System;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
using System.Runtime.Serialization;<br />
<br />
namespace SimpleUtil<br />
{<br />
    [Serializable()]<br />
    class ServiceProvider : SimpleUtil.IServiceProvider<br />
    {<br />
        public void DoWork(string Message)<br />
        {<br />
            Console.WriteLine("SimpleUtil.DoWork");<br />
            return;<br />
        }<br />
<br />
        public ServiceProvider()<br />
        {<br />
            return;<br />
        }<br />
<br />
        public ServiceProvider(SerializationInfo info, StreamingContext context)<br />
        {<br />
            return;<br />
        }<br />
<br />
        public void GetObjectData(<br />
            SerializationInfo info,<br />
            StreamingContext context<br />
        )<br />
        {<br />
            return;<br />
        }<br />
   <br />
    }<br />
}<br />
<br />
using System;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
using System.Runtime.Serialization;<br />
<br />
namespace SimpleUtil<br />
{<br />
    public interface IServiceProvider : ISerializable<br />
    {<br />
        void DoWork(string Message);<br />
    }<br />
}<br />
<br />
<br />
***** UserUtil.ServiceProvider *****<br />
using System;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
#region "Inheritance security rules violated while overriding member" runtime error<br />
/*<br />
ATTN: <br />
In implementing ISerializable of class below, you'd need to override "GetObjectData" and in .NET 4, this'd give runtime error <br />
    "Inheritance security rules violated while overriding member: 'UserUtil.ServiceProvider.GetObjectData(System.Runtime.Serialization.SerializationInfo, System.Runtime.Serialization.StreamingContext)'. Security accessibility of the overriding method must match the security accessibility of the method being overriden."<br />
This runtime error happens when:<br />
       oProvider = Activator.CreateInstanceFrom(<br />
                    UserDomain, ThirdPartyDll, ThirdPartyServiceFullyQualifiedName<br />
                );<br />
Two options:<br />
 a. [assembly: SecurityRules(SecurityRuleSet.Level1)]<br />
    But this relaxes defaults, and thus undesirable<br />
 b. Apply attrib below - unfortunately it doesn't work<br />
    [SecurityCriticalAttribute()] --> This requires "using System.Security"<br />
        public void GetObjectData(<br />
            SerializationInfo info,<br />
            StreamingContext context<br />
        )<br />
        {<br />
            return;<br />
        }<br />
REF: <br />
 http://stackoverflow.com/questions/3055792/inheritance-security-rules-violated-while-overriding-member-securityruleset-lev<br />
 http://msdn.microsoft.com/en-us/library/system.security.securitycriticalattribute.aspx<br />
 */<br />
#endregion<br />
<br />
using System.Security;<br />
using System.Security.Policy;<br />
using System.Security.Permissions;<br />
<br />
using System.Runtime.Serialization;<br />
<br />
using SimpleUtil;<br />
<br />
namespace UserUtil<br />
{<br />
    [Serializable()]<br />
    public class ServiceProvider : MarshalByRefObject, SimpleUtil.IServiceProvider<br />
<br />
    {<br />
        public void DoWork(string Message)<br />
        {<br />
            // throw new Exception("Testing - Exception blowing up in third party library (still kills the hosting app what the hell)");<br />
<br />
            object oSecret = null;<br />
            string secret = null;<br />
<br />
            oSecret = AppDomain.CurrentDomain.GetData("KEY1");<br />
            if (oSecret != null)<br />
            {<br />
                secret = (string)oSecret;<br />
                Console.WriteLine("UserUtil.DoWork - secret=" + secret); // This is accessing new/UserUtil AppDomain!! Good!<br />
            }<br />
            else<br />
            {<br />
                Console.WriteLine("UserUtil.DoWork - secret=NULL!");<br />
            }<br />
            return;<br />
        }<br />
<br />
        public ServiceProvider()<br />
        {<br />
            return;<br />
        }<br />
<br />
        public ServiceProvider(SerializationInfo info, StreamingContext context)<br />
        {<br />
            return;<br />
        }<br />
<br />
        [SecurityCriticalAttribute()]<br />
        public void GetObjectData(<br />
            SerializationInfo info,<br />
            StreamingContext context<br />
        )<br />
        {<br />
            return;<br />
        }<br />
    }<br />
}<br />

dev
modified on Saturday, March 5, 2011 6:47 AM

GeneralRe: How do you protect your app hosting third party dll ...? Pin
Eddy Vluggen5-Mar-11 3:02
professionalEddy Vluggen5-Mar-11 3:02 
GeneralRe: How do you protect your app hosting third party dll ...? Pin
devvvy5-Mar-11 14:24
devvvy5-Mar-11 14:24 
GeneralRe: How do you protect your app hosting third party dll ...? Pin
Eddy Vluggen7-Mar-11 0:41
professionalEddy Vluggen7-Mar-11 0:41 
GeneralRe: How do you protect your app hosting third party dll ...? Pin
devvvy7-Mar-11 14:27
devvvy7-Mar-11 14:27 
QuestionUpdate progress bar on another form Pin
Etienne_1232-Mar-11 21:28
Etienne_1232-Mar-11 21:28 
AnswerRe: Update progress bar on another form Pin
musefan2-Mar-11 22:29
musefan2-Mar-11 22:29 
GeneralRe: Update progress bar on another form Pin
Etienne_1233-Mar-11 21:17
Etienne_1233-Mar-11 21:17 
AnswerRe: Update progress bar on another form Pin
DaveyM693-Mar-11 1:13
professionalDaveyM693-Mar-11 1:13 
GeneralRe: Update progress bar on another form Pin
Luc Pattyn3-Mar-11 1:36
sitebuilderLuc Pattyn3-Mar-11 1:36 
GeneralRe: Update progress bar on another form Pin
DaveyM693-Mar-11 3:58
professionalDaveyM693-Mar-11 3:58 
GeneralRe: Update progress bar on another form Pin
Etienne_1233-Mar-11 20:00
Etienne_1233-Mar-11 20:00 
QuestionPausing execution for certain amount of time without freezing the form. Pin
john1234512-Mar-11 14:48
john1234512-Mar-11 14:48 
AnswerRe: Pausing execution for certain amount of time without freezing the form. Pin
Luc Pattyn2-Mar-11 15:31
sitebuilderLuc Pattyn2-Mar-11 15:31 
AnswerRe: Pausing execution for certain amount of time without freezing the form. Pin
OriginalGriff2-Mar-11 21:19
mveOriginalGriff2-Mar-11 21:19 
GeneralRe: Pausing execution for certain amount of time without freezing the form. Pin
Luc Pattyn3-Mar-11 0:53
sitebuilderLuc Pattyn3-Mar-11 0:53 
AnswerRe: Pausing execution for certain amount of time without freezing the form. Pin
musefan2-Mar-11 22:20
musefan2-Mar-11 22:20 
QuestionConsole in c# 2008 Express Pin
Bob Pawley2-Mar-11 12:47
Bob Pawley2-Mar-11 12:47 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.