.NET CGI script has inadequate permissions to receive form data ???

**Graham** · Jul 24 '08, 03:45 PM

I'm trying to write a CGI script in C#; it receives data from an HTML
form via the POST method, and tries to read the form data using
System.Environm ent.GetEnvironm entVariable(). Which is where I have a
problem. When I use a 32-bit build of the CGI script, everything works
swimmingly. But when I use a 64-bit build of the CGI script,
GetEnvironmentV ariable() throws a System.Security .SecurityExcept ion
saying it doesn't have permission to read the environment variable.
(I'm running Windows XP Professional x64 and .NET 2.0 SP1 64 bit, and
my web server is IIS 6.)

There must be something I'm missing, because if not, then it would be
impossible to write 64-bit CGI scripts in C# that use the POST method.
But: does anyone have any theories?

I've tried getting Visual Studio to sign the executable, to no avail.
And oddly, I can set the 32-bit build of the executable to be fully
trusted (using "caspol -af CgiScript.exe) but if I try to do the same
thing with the 64-bit build I get an "ERROR: Unable to load assembly".

My HTML form, CGI source code, and the 64-bit output (including the
exception) are below.

Cheers!

//////////////////////////////////////////////////////////////////////////

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"<html
xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>This will load CgiScript.exe</title>
</head>
<body>

<form action="CgiScri pt.exe", method="POST" id="MyForm">
<input type="checkbox" value="chkbox1" />Text1
<input type="checkbox" value="chkbox2" />Text2
<input type="submit" name="submit1" value="Submit1" />
<input type="submit" name="submit2" value="Submit2" />
</form>
</body>
</html>

//////////////////////////////////////////////////////////////////////////

namespace CgiScript
{
class Program
{
private static string GetProcessEnvir onmentVariable( string
variable)
{
System.Console. WriteLine("Abou t to get env var");
string value00 =
System.Environm ent.GetEnvironm entVariable(
variable, System.Environm entVariableTarg et.Process
);
System.Console. WriteLine("Got env var");

if (null == value00) {
ReturnError("Mi ssing value: " + variable);
}

return value00;
}

private static void ReturnError(str ing err)
{
System.Console. WriteLine();
System.Console. WriteLine();
System.Console. WriteLine(err);
}

public static void Main(string[] args)
{
try {
System.Console. WriteLine("Cont ent-Type: text/plain");
System.Console. WriteLine();
System.Console. WriteLine();

string request_method =
GetProcessEnvir onmentVariable( "REQUEST_METHOD ");
if (null == request_method) {
ReturnError("Mi ssing value REQUEST_METHOD" );
return;
}

} catch (System.Excepti on exc) {
ReturnError(exc .ToString());
}
}
}
}

//////////////////////////////////////////////////////////////////////////

About to get env var

System.Security .SecurityExcept ion: Request for the permission of type
'System.Securit y.Permissions.E nvironmentPermi ssion, mscorlib,
Version=2.0.0.0 , Culture=neutral , PublicKeyToken= b77a5c561934e08 9'
failed.
at System.Security .CodeAccessSecu rityEngine.Chec k(Object demand,
StackCrawlMark& stackMark, Boolean isPermSet)
at System.Security .CodeAccessPerm ission.Demand()
at System.Environm ent.GetEnvironm entVariable(Str ing variable)
at System.Environm ent.GetEnvironm entVariable(Str ing variable,
EnvironmentVari ableTarget target)
at CgiScript.Progr am.GetProcessEn vironmentVariab le(String variable)
at CgiScript.Progr am.Main(String[] args)
The action that failed was:
Demand
The type of the first permission that failed was:
System.Security .Permissions.En vironmentPermis sion
The Zone of the assembly that failed was:
Internet