dynamic reflection from xml file security

[TS]

i have code that creates assemblies and classes from the assemlby and
methods from the classes to set properties of dynamically created controls.

How i should go about validating the assemblies, classes, & properties
declared in the xml file?

Thanks

[Nicholas Paldino [.NET/C# MVP]]

Re: dynamic reflection from xml file security

TS,

Can you be more specific with what you mean by validating? How are
these things declared in the XML file?

If you are creating an assembly, then you are using the reflection
api's, or you are generating C# code and compiling on the fly. Either, way,
you should get an error if the code is not valid.

Can you provide more information?


--
- Nicholas Paldino [.NET/C# MVP]
- mvp@spam.guard. caspershouse.co m

"TS" <manofsteele1@n ospam.nospam> wrote in message
news:e4jX6cTFGH A.2708@TK2MSFTN GP11.phx.gbl...[color=blue]
>i have code that creates assemblies and classes from the assemlby and
>methods from the classes to set properties of dynamically created controls.
>
> How i should go about validating the assemblies, classes, & properties
> declared in the xml file?
>
> Thanks
>[/color]

[TS]

Re: dynamic reflection from xml file security

controlAssembly TypeName="XXX.X XXXX.Web"
controlTypeName ="XXX.XXXXX.Web .Controls.Stand ardCriteria"

And then there are xml sub elements listing all the properties to set on the
standard criteria class

I am using the following method to find the assembly based on the name
declared in xml file and using it to instantiate the class declared in
controlTypeName :

private Assembly GetAssembly(str ing assemblyTypeNam e){

foreach(Assembl y assembly in AppDomain.Curre ntDomain.GetAss emblies()){

if(assembly.Get Name().Name == assemblyTypeNam e)
return assembly;
}

return null;

}

This could let them find a System assembly

Later to create the class instance i do the following:

// Use reflection to create control
control = (Control) assembly.Create Instance(contro lTypeName);



"Nicholas Paldino [.NET/C# MVP]" <mvp@spam.guard .caspershouse.c om> wrote in
message news:O7TM9gTFGH A.2696@TK2MSFTN GP14.phx.gbl...[color=blue]
> TS,
>
> Can you be more specific with what you mean by validating? How are
> these things declared in the XML file?
>
> If you are creating an assembly, then you are using the reflection
> api's, or you are generating C# code and compiling on the fly. Either,
> way, you should get an error if the code is not valid.
>
> Can you provide more information?
>
>
> --
> - Nicholas Paldino [.NET/C# MVP]
> - mvp@spam.guard. caspershouse.co m
>
> "TS" <manofsteele1@n ospam.nospam> wrote in message
> news:e4jX6cTFGH A.2708@TK2MSFTN GP11.phx.gbl...[color=green]
>>i have code that creates assemblies and classes from the assemlby and
>>methods from the classes to set properties of dynamically created
>>controls.
>>
>> How i should go about validating the assemblies, classes, & properties
>> declared in the xml file?
>>
>> Thanks
>>[/color]
>
>[/color]

[Nicholas Paldino [.NET/C# MVP]]

Re: dynamic reflection from xml file security

TS,

Ok, I kind of understand what you are doing now.

In order to load the assembly, you don't have to check the assemblies in
the current domain. Rather, you should just call one of the Load methods in
the Assembly class. If the assembly is loaded already, then it will return
that. If not, it will load the assembly.

To get the type, call the GetType method on the Assembly instance that
you loaded.

Then, you call CreateInstance on the Activator class to create the
instance.

From there, you can call GetProperty on the Type to get the property,
and then call the SetValue method on the PropertyInfo returned from the call
to GetProperty to set the value (passing in your instance returned from
CreateInstance) .


--
- Nicholas Paldino [.NET/C# MVP]
- mvp@spam.guard. caspershouse.co m

"TS" <manofsteele1@n ospam.nospam> wrote in message
news:e5q%23HAUF GHA.1032@TK2MSF TNGP11.phx.gbl. ..[color=blue]
> controlAssembly TypeName="XXX.X XXXX.Web"
> controlTypeName ="XXX.XXXXX.Web .Controls.Stand ardCriteria"
>
> And then there are xml sub elements listing all the properties to set on
> the standard criteria class
>
> I am using the following method to find the assembly based on the name
> declared in xml file and using it to instantiate the class declared in
> controlTypeName :
>
> private Assembly GetAssembly(str ing assemblyTypeNam e){
>
> foreach(Assembl y assembly in AppDomain.Curre ntDomain.GetAss emblies()){
>
> if(assembly.Get Name().Name == assemblyTypeNam e)
> return assembly;
> }
>
> return null;
>
> }
>
> This could let them find a System assembly
>
> Later to create the class instance i do the following:
>
> // Use reflection to create control
> control = (Control) assembly.Create Instance(contro lTypeName);
>
>
>
> "Nicholas Paldino [.NET/C# MVP]" <mvp@spam.guard .caspershouse.c om> wrote
> in message news:O7TM9gTFGH A.2696@TK2MSFTN GP14.phx.gbl...[color=green]
>> TS,
>>
>> Can you be more specific with what you mean by validating? How are
>> these things declared in the XML file?
>>
>> If you are creating an assembly, then you are using the reflection
>> api's, or you are generating C# code and compiling on the fly. Either,
>> way, you should get an error if the code is not valid.
>>
>> Can you provide more information?
>>
>>
>> --
>> - Nicholas Paldino [.NET/C# MVP]
>> - mvp@spam.guard. caspershouse.co m
>>
>> "TS" <manofsteele1@n ospam.nospam> wrote in message
>> news:e4jX6cTFGH A.2708@TK2MSFTN GP11.phx.gbl...[color=darkred]
>>>i have code that creates assemblies and classes from the assemlby and
>>>methods from the classes to set properties of dynamically created
>>>controls.
>>>
>>> How i should go about validating the assemblies, classes, & properties
>>> declared in the xml file?
>>>
>>> Thanks
>>>[/color]
>>
>>[/color]
>
>[/color]

[TS]

Re: dynamic reflection from xml file security

Ok, i have it working now, but your way is probably better...but what about
validating the assembly and class entered in the xml file...in case the xml
file was hijacked and they maybe used a system assembly and tried to execute
system commands, etc. How do i lock down this type of interface?

thanks

"Nicholas Paldino [.NET/C# MVP]" <mvp@spam.guard .caspershouse.c om> wrote in
message news:eNBbuaYFGH A.2892@TK2MSFTN GP10.phx.gbl...[color=blue]
> TS,
>
> Ok, I kind of understand what you are doing now.
>
> In order to load the assembly, you don't have to check the assemblies
> in the current domain. Rather, you should just call one of the Load
> methods in the Assembly class. If the assembly is loaded already, then it
> will return that. If not, it will load the assembly.
>
> To get the type, call the GetType method on the Assembly instance that
> you loaded.
>
> Then, you call CreateInstance on the Activator class to create the
> instance.
>
> From there, you can call GetProperty on the Type to get the property,
> and then call the SetValue method on the PropertyInfo returned from the
> call to GetProperty to set the value (passing in your instance returned
> from CreateInstance) .
>
>
> --
> - Nicholas Paldino [.NET/C# MVP]
> - mvp@spam.guard. caspershouse.co m
>
> "TS" <manofsteele1@n ospam.nospam> wrote in message
> news:e5q%23HAUF GHA.1032@TK2MSF TNGP11.phx.gbl. ..[color=green]
>> controlAssembly TypeName="XXX.X XXXX.Web"
>> controlTypeName ="XXX.XXXXX.Web .Controls.Stand ardCriteria"
>>
>> And then there are xml sub elements listing all the properties to set on
>> the standard criteria class
>>
>> I am using the following method to find the assembly based on the name
>> declared in xml file and using it to instantiate the class declared in
>> controlTypeName :
>>
>> private Assembly GetAssembly(str ing assemblyTypeNam e){
>>
>> foreach(Assembl y assembly in AppDomain.Curre ntDomain.GetAss emblies()){
>>
>> if(assembly.Get Name().Name == assemblyTypeNam e)
>> return assembly;
>> }
>>
>> return null;
>>
>> }
>>
>> This could let them find a System assembly
>>
>> Later to create the class instance i do the following:
>>
>> // Use reflection to create control
>> control = (Control) assembly.Create Instance(contro lTypeName);
>>
>>
>>
>> "Nicholas Paldino [.NET/C# MVP]" <mvp@spam.guard .caspershouse.c om> wrote
>> in message news:O7TM9gTFGH A.2696@TK2MSFTN GP14.phx.gbl...[color=darkred]
>>> TS,
>>>
>>> Can you be more specific with what you mean by validating? How are
>>> these things declared in the XML file?
>>>
>>> If you are creating an assembly, then you are using the reflection
>>> api's, or you are generating C# code and compiling on the fly. Either,
>>> way, you should get an error if the code is not valid.
>>>
>>> Can you provide more information?
>>>
>>>
>>> --
>>> - Nicholas Paldino [.NET/C# MVP]
>>> - mvp@spam.guard. caspershouse.co m
>>>
>>> "TS" <manofsteele1@n ospam.nospam> wrote in message
>>> news:e4jX6cTFGH A.2708@TK2MSFTN GP11.phx.gbl...
>>>>i have code that creates assemblies and classes from the assemlby and
>>>>methods from the classes to set properties of dynamically created
>>>>controls.
>>>>
>>>> How i should go about validating the assemblies, classes, & properties
>>>> declared in the xml file?
>>>>
>>>> Thanks
>>>>
>>>
>>>[/color]
>>
>>[/color]
>
>[/color]

[Kevin Yu [MSFT]]

Re: dynamic reflection from xml file security

Hi TS,

What do you mean by executing a system command? If the assembly is comming
from an untrusted source, I suggest you create a code group and not giving
the assembly full permission for executing.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[TS]

Re: dynamic reflection from xml file security

>If the assembly is comming[color=blue]
> from an untrusted source, I suggest you create a code group and not giving
> the assembly full permission for executing.[/color]
The only assemblies would be framework assemblies
[color=blue]
> What do you mean by executing a system command?[/color]
I mean is there any class in the .net framework that by ONLY instantiating
it and optionally setting some of its properties would could cause a
security risk or other ill effects?

See, i am allowing server controls to be instantiated by supplying its name
and assembly name for the sole purpose of dynamically putting it on a web
page as well as setting properties of that control thru the xml. Methods of
the control are not envoked, on thing supplied to option to set properties
of this control.

I want to make sure i don't have a security risk in my xml file that could
get hijacked on the server and be manipulated in some way to do harm or
other issues to a production box.

thanks

"Kevin Yu [MSFT]" <v-kevy@online.mic rosoft.com> wrote in message
news:UZynWGyFGH A.224@TK2MSFTNG XA02.phx.gbl...[color=blue]
> Hi TS,
>
> What do you mean by executing a system command? If the assembly is comming
> from an untrusted source, I suggest you create a code group and not giving
> the assembly full permission for executing.
>
> Kevin Yu
> =======
> "This posting is provided "AS IS" with no warranties, and confers no
> rights."
>[/color]

[Kevin Yu [MSFT]]

Re: dynamic reflection from xml file security

Hi TS,

In this case, I think the best way is to give the assembly limited
permission set, so that the assembly will not do anything harmful if the
xml is hijacked.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[TS]

Re: dynamic reflection from xml file security

can i give permissions embedded in the code so that no server or environment
changes have to be done?


"Kevin Yu [MSFT]" <v-kevy@online.mic rosoft.com> wrote in message
news:fl8nThBGGH A.3944@TK2MSFTN GXA02.phx.gbl.. .[color=blue]
> Hi TS,
>
> In this case, I think the best way is to give the assembly limited
> permission set, so that the assembly will not do anything harmful if the
> xml is hijacked.
>
> Kevin Yu
> =======
> "This posting is provided "AS IS" with no warranties, and confers no
> rights."
>[/color]

[Kevin Yu [MSFT]]

Re: dynamic reflection from xml file security

Hi TS,

This policy cannot be set from the code. Because if it can be set by code,
the hackers can also do that. Then it will be no use. It can only be set
from the .NET configuration setting from in the administrative tools.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."