在.Net Framework中提供了代码访问安全性(Code Access Security)，它的主要作用就是限制代码的使用权限。可以控制各种系统资源的访问权限、可以要求代码的调用方拥有特定的权限......。比如我们可以控制自己的dll只能在什么条件下由什么人调用，特别是在Asp.net中可以限制不同代码的安全权限，从源头限制住网络上的攻击等。
本文的主要内容如下：
1、在Asp.Net中使用自定义的信任级别
2、配置Sqlconnection的代码访问权限
3、实现和使用一个最简版的自定义权限
在Asp.Net中使用自定义的信任级别
Asp.Net默认在C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config中配置了网站的信任级别：
<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->
<
securityPolicy
>
<
trustLevel
name
="Full"
policyFile
="internal"
/>
<
trustLevel
name
="High"
policyFile
="web_hightrust.config"
/>
<
trustLevel
name
="Medium"
policyFile
="web_mediumtrust.config"
/>
<
trustLevel
name
="Low"
policyFile
="web_lowtrust.config"
/>
<
trustLevel
name
="Minimal"
policyFile
="web_minimaltrust.config"
/>
</
securityPolicy
>
<
trust
level
="Full"
originUrl
=""
/>
默认为Full，表示拥有最大的权限，当然风险也就最高，我们可以在自己的网站下的web.config中自定义信任级别：
<
securityPolicy
>
<
trustLevel
name
="Full"
policyFile
="internal"
/>
<
trustLevel
name
="High"
policyFile
="web_hightrust.config"
/>
<
trustLevel
name
="Medium"
policyFile
="web_mediumtrust.config"
/>
<
trustLevel
name
="Low"
policyFile
="web_lowtrust.config"
/>
<
trustLevel
name
="Minimal"
policyFile
="web_minimaltrust.config"
/>
</
securityPolicy
>
<
trust
level
="Full"
originUrl
=""
/>
<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->
<
securityPolicy
>
<
trustLevel
name
="Custom"
policyFile
="E:\_NetProject\PermissionTrust\WebSite11\web_customtrust.config"
/>
</
securityPolicy
>
<
trust
level
="Custom"
originUrl
=""
/>
<
securityPolicy
>
<
trustLevel
name
="Custom"
policyFile
="E:\_NetProject\PermissionTrust\WebSite11\web_customtrust.config"
/>
</
securityPolicy
>
<
trust
level
="Custom"
originUrl
=""
/>
这里使用了自定义的配置文件，其实也就是复制C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_lowtrust.config文件，然后在此文件上进行适当修改就可以了(使用此配置默认是不允许连接数据库的)
配置Sqlconnection的代码访问权限
配置的方法就是修改自定义的web_customtrust.config文件，修改后的文件如下所示：粗体部分为修改点
web_customtrust.config
<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->
<configuration><mscorlib><security><policy><PolicyLevelversion="1"><SecurityClasses><SecurityClassName="AllMembershipCondition"Description="System.Security.Policy.AllMembershipCondition,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="AspNetHostingPermission"Description="System.Web.AspNetHostingPermission,System,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="FileIOPermission"Description="System.Security.Permissions.FileIOPermission,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="FirstMatchCodeGroup"Description="System.Security.Policy.FirstMatchCodeGroup,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="IsolatedStorageFilePermission"Description="System.Security.Permissions.IsolatedStorageFilePermission,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="NamedPermissionSet"Description="System.Security.NamedPermissionSet"/><SecurityClassName="SecurityPermission"Description="System.Security.Permissions.SecurityPermission,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="StrongNameMembershipCondition"Description="System.Security.Policy.StrongNameMembershipCondition,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="UnionCodeGroup"Description="System.Security.Policy.UnionCodeGroup,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="UrlMembershipCondition"Description="System.Security.Policy.UrlMembershipCondition,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="ZoneMembershipCondition"Description="System.Security.Policy.ZoneMembershipCondition,mscorlib,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/><SecurityClassName="SqlClientPermission"Description="System.Data.SqlClient.SqlClientPermission,System.Data,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b77a5c561934e089"/></SecurityClasses><NamedPermissionSets><PermissionSetclass="NamedPermissionSet"version="1"Unrestricted="true"Name="FullTrust"Description="Allowsfullaccesstoallresources"/><PermissionSetclass="NamedPermissionSet"version="1"Name="Nothing"Description="Deniesallresources,includingtherighttoexecute"/><PermissionSetclass="NamedPermissionSet"version="1"Name="ASP.Net"><IPermissionclass="AspNetHostingPermission"version="1"Level="High"/><IPermissionclass="FileIOPermission"version="1"Read="$AppDir$"PathDiscovery="$AppDir$"/><IPermissionclass="IsolatedStorageFilePermission"version="1"Allowed="AssemblyIsolationByUser"UserQuota="1048576"/><IPermissionclass="SecurityPermission"version="1"Flags="Execution"/><IPermissionclass="SqlClientPermission"version="1"><addConnectionString="datasource=dbserver;initialcatalog=db1"KeyRestrictions="UserID=;Password=;ConnectionReset="KeyRestrictionBehavior="AllowOnly"/></IPermission></NamedPermissionSets><CodeGroupclass="FirstMatchCodeGroup"version="1"PermissionSetName="Nothing"><IMembershipConditionclass="AllMembershipCondition"version="1"/><CodeGroupclass="UnionCodeGroup"version="1"PermissionSetName="ASP.Net"><IMembershipConditionclass="UrlMembershipCondition"version="1"Url="$AppDirUrl$/*"/></CodeGroup><CodeGroupclass="UnionCodeGroup"version="1"PermissionSetName="ASP.Net"><IMembershipConditionclass="UrlMembershipCondition"version="1"Url="$CodeGen$/*"/></CodeGroup><CodeGroupclass="UnionCodeGroup"version="1"PermissionSetName="Nothing"><IMembershipConditionclass="ZoneMembershipCondition"version="1"Zone="MyComputer"/><CodeGroupclass="UnionCodeGroup"version="1"PermissionSetName="FullTrust"Name="Microsoft_Strong_Name"Description="ThiscodegroupgrantscodesignedwiththeMicrosoftstrongnamefulltrust."><IMembershipConditionclass="StrongNameMembershipCondition"version="1"PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010007D1FA57C4AED9F0A32E84AA0FAEFD0DE9E8FD6AEC8F87FB03766C834C99921EB23BE79AD9D5DCC1DD9AD236132102900B723CF980957FC4E177108FC607774F29E8320E92EA05ECE4E821C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D745D6F2DE5F17E5EAF0FC4963D261C8A12436518206DC093344D5AD293"/></CodeGroup><CodeGroupclass="UnionCodeGroup"version="1"PermissionSetName="FullTrust"Name="Ecma_Strong_Name"Description="ThiscodegroupgrantscodesignedwiththeECMAstrongnamefulltrust."><IMembershipConditionclass="StrongNameMembershipCondition"version="1"PublicKeyBlob="00000000000000000400000000000000"/></CodeGroup></CodeGroup></CodeGroup></PolicyLevel></policy></security></mscorlib></configuration>
加入以上的配置后限制使用SqlConnection时只能访问dbserver上的db1数据库，不能访问其他数据库，用户名密码等可以自由输入，也就是在代码中只能：
<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->
SqlConnectionconnection
=
new
SqlConnection(
"
datasource=dbserver;UserID=gspring;Password=***;initialcatalog=db1
"
)
SqlConnectionconnection
=
new
SqlConnection(
"
datasource=dbserver;UserID=gspring;Password=***;initialcatalog=db1
"
)
如果连接其他数据库就会报错：
<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->
说明:应用程序试图执行安全策略不允许的操作。要授予此应用程序所需的权限，请与系统管理员联系，或在配置文件中更改该应用程序的信任级别。
异常详细信息:System.Security.SecurityException:请求“System.Data.SqlClient.SqlClientPermission,System.Data,Version
=
2.0
.
0.0
,Culture
=
neutral,PublicKeyToken
=
b77a5c561934e089”类型的权限已失败。
说明:应用程序试图执行安全策略不允许的操作。要授予此应用程序所需的权限，请与系统管理员联系，或在配置文件中更改该应用程序的信任级别。异常详细信息:System.Security.SecurityException:请求“System.Data.SqlClient.SqlClientPermission,System.Data,Version
=
2.0
.
0.0
,Culture
=
neutral,PublicKeyToken
=
b77a5c561934e089”类型的权限已失败。
这样就从源头上限制住了数据库的连接操作。
当然如果希望可以连接任意数据库，可以修改为如下配置：
<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->
<
IPermission
class
="SqlClientPermission"
version
="1"
Unrestricted
="true"
/>
<
IPermission
class
="SqlClientPermission"
version
="1"
Unrestricted
="true"
/>
实现和使用一个最简版的自定义权限
自定义一个代码访问权限需要从CodeAccessPermission继承，并且要实现IUnrestrictedPermission接口，主要需实现的方法有：
Copy 创建当前权限对象的副本。
Intersect 返回当前类与传递的类所允许权限的交集。
IsSubsetOf 如果传递的权限包括当前权限允许的一切操作，则 IsSubsetOf 返回 true。
FromXml 对您的自定义权限的 XML 表示形式进行解码。
ToXml 对您的自定义权限的 XML 表示形式进行编码。
Union 创建一个权限，该权限是当前权限与指定权限的并集。
<!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->
1
using
System;
2
using
System.Text;
3
using
System.Security;
4
using
System.Security.Permissions;
5
6
namespace
MyPermission
7
{
8
[Serializable]
9publicsealedclassCustomPermission:CodeAccessPermission,IUnrestrictedPermission
10
{
11privateDateTime_expiredDate;
12
13publicDateTimeExpiredDate
14{
15get{return_expiredDate;}
16set{_expiredDate=value;}
17
}
18
19publicCustomPermission()
20{
21}
22
23//必须有这个方法，CAS系统会调用此方法的
24publicCustomPermission(PermissionStatestate)
25{
26}
27
28publicboolIsUnrestricted()
29{
30returnfalse;
31}
32
33publicoverrideIPermissionCopy()
34{
35CustomPermissioncopy=newCustomPermission();
36copy.ExpiredDate=this.ExpiredDate;
37
38returncopy;
39}
40
41publicoverrideIPermissionIntersect(IPermissiontarget)
42{
43if(null==target)
44{
45returnnull;
46}
47else
48{
49returntarget;
50}
51}
52
53privateboolCheckDate(DateTimedate)
54{
55if(System.DateTime.Now.CompareTo(date)<0
using
System;2
using
System.Text;3
using
System.Security;4
using
System.Security.Permissions;5
6
namespace
MyPermission7
{8
[Serializable]9
publicsealedclassCustomPermission:CodeAccessPermission,IUnrestrictedPermission10
{11
privateDateTime_expiredDate;12
13
publicDateTimeExpiredDate14
{15
get{return_expiredDate;}16
set{_expiredDate=value;}17
}18
19
publicCustomPermission()20
{21
}22
23
//必须有这个方法，CAS系统会调用此方法的24
publicCustomPermission(PermissionStatestate)25
{26
}27
28
publicboolIsUnrestricted()29
{30
returnfalse;31
}32
33
publicoverrideIPermissionCopy()34
{35
CustomPermissioncopy=newCustomPermission();36
copy.ExpiredDate=this.ExpiredDate;37
38
returncopy;39
}40
41
publicoverrideIPermissionIntersect(IPermissiontarget)42
{43
if(null==target)44
{45
returnnull;46
}47
else48
{49
returntarget;50
}51
}52
53
privateboolCheckDate(DateTimedate)54
{55
if(System.DateTime.Now.CompareTo(date)<0
221
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
