我是否需要担心仅完全信任的 .EXE 中的链接需求？
我正在尝试理解 FxCop CA2122 消息（可能在禁用那些糟糕的东西之前），并且我显然超出了我对 .NET CAS 的理解。
该应用程序是一个 .EXE，未标记有AllowPartiallyTrustedCallers。我们从代码分析中收到 CA2122 警告，抱怨我们未能将 LinkDemands 从最低级别的调用向上传播到本身具有 LinkDemands 的方法。
显然，我们可以将 LinkDemands 放在呼叫者身上，然后是呼叫者的呼叫者，无限循环。这似乎完全没有目的，因为该代码的每次调用都将始终是完全信任的，因此（AIUI）每个链接需求无论如何都将始终得到满足。埃里克·利珀特 (Eric Lippert) 似乎也认为这样做非常危险。
那么：
我缺少什么程序集级属性来表示“此代码只能在完全信任的情况下运行”？ （我认为缺少AllowPartiallyTrustedCallers'暗示了这一点，但也许不是对于.EXE）
或者我应该关闭该CA警告并继续吗？我确实喜欢在禁用它们之前正确理解它们...
更新：我被问到我们正在使用哪个框架版本 - 它是 2.0RTM，并且升级到超过该点非常困难，因为它位于 XPe 平台上。
I'm trying to understand FxCop CA2122 messages (probably before disabling the wretched things), and I have clearly overstepped my understanding of .NET CAS.
The application is a .EXE, not marked with AllowPartiallyTrustedCallers. We get CA2122 warnings from Code Analysis, complaining about our failure to propagate LinkDemands upwards from the lowest level of calls to methods which themselves have LinkDemands.
Obviously we can run around putting LinkDemands on callers, and then callers of callers, ad-infinitum. This seems entirely purposeless, as every invocation of this code is always going to be full-trust, and hence (AIUI) every link demand is always going to be met anyway. Eric Lippert seems to think it's highly dangerous to do that, too.
So:
What assembly-level attribute am I missing to say 'this code will only run at full-trust'? (I thought the absence of AllowPartiallyTrustedCallers' implied this, but perhaps not for .EXEs)
Or should I just turn off that CA warning and move on? I do like to understand them properly before I disable them...
Update: I was asked which framework version we're using - it's 2.0RTM, and it's extremely difficult to get upgraded past that point because it's on an XPe platform.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您认为程序集只能作为完全受信任的可执行文件运行的基本假设是错误的。没有什么可以阻止能够获取您的程序集的人将其用作恶意软件中引用的库程序集。如果您更改了计算机的 CAS 策略以向您的程序集授予完全信任，无论其如何部署，则恶意软件可能能够使用您的程序集来执行其原本没有足够权限的操作。
这样做的结果是，无论您的预期部署场景如何，您确实应该采取一些措施来防止代表调用代码满足链接需求。鉴于您自己的目标是完全信任场景，这实际上会非常容易。
但是，确切的方法很大程度上取决于您所针对的 .NET Framework 的版本，因此您可以发布该详细信息吗？对于 .NET 2.0，解决该问题的最简单方法是将 SecurityTransparentAttribute 或 SecurityCriticalAttribute 应用于程序集。默认情况下，这两个属性都会导致程序集中的代码变得安全透明，这意味着它无法代表其调用者执行诸如满足链接要求之类的操作。如果代码的某些部分需要执行安全透明代码不允许的操作，则应在程序集级别使用 SecurityCriticalAttribute 而不是 SecurityTransparentAttribute，因为这将允许您显式将类型和/或成员提升为安全性 -如果他们需要的话，就至关重要。 （有关更多详细信息，请参阅 链接。）
Your underlying assumption that the assembly will only ever run as a fully trusted executable is faulty. There's nothing stopping someone who can get their hands on your assembly from using it as a referenced library assembly in a piece of malware. If you've altered a machine's CAS policy to grant full trust to your assembly regardless of how it's deployed, then the malware would potentially be able to use your assembly to execute operations for which it would otherwise not have had adequate permissions.
The upshot of this is that you really ought to be doing something to prevent satisfying link demands on the behalf of calling code, regardless of your intended deployment scenario. Given that you're targeting a full trust scenario yourself, this is actually going to be pretty easy.
However, the exact approach depends largely on which version of the .NET Framework you're targeting, so could you please post that detail?For .NET 2.0, the simplest approach to addressing the issue would be to apply either SecurityTransparentAttribute or SecurityCriticalAttribute to your assembly. Both attributes will result in the code in your assembly becoming security-transparent by default, which means that it cannot do things like satisfy link demands on behalf of its callers. If there are parts of your code that need to do things that are not allowed to security-transparent code, you should use the SecurityCriticalAttribute instead of SecurityTransparentAttribute at the assembly level since this will allow you to explicitly promote types and/or members to security-criticality if they need it. (For a bit more detail, see Link.)
如果我理解正确的话：
http://msdn.microsoft.com/en-us/library /system.security.allowpartiallytrustedcallersattribute.aspx
链接需求属性告诉 .NET 强制执行该方法的完全信任规则。这也需要一个响亮的名字。虽然您的应用程序树可能处于完全信任的环境中，但没有任何内容可以强制执行公共/受保护方法和类的规则。
AllowPartiallyTrustedCallers 告诉 .NET 您不关心谁调用它。
.NET 4 中的安全模型似乎发生了变化。
If I'm understanding this correctly:
http://msdn.microsoft.com/en-us/library/system.security.allowpartiallytrustedcallersattribute.aspx
The Link demand attributes tell .NET to enforce the full trust rule for the method. This also requires a strong name. While your app tree may be in a full trust environment, nothing is enforcing the rule for the public/protected methods and classes.
The AllowPartiallyTrustedCallers tells .NET you don't care who calls it.
Seems the security model changes in .NET 4.