1

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this article) to do just that. Here it is

<CodeGroup
    class="UnionCodeGroup"
    version="1"
    Name="SecurityExtensionCodeGroup"
    Description="Code group for the sample security extension"
    PermissionSetName="FullTrust">
    <IMembershipCondition
        class="UrlMembershipCondition"
        version="1"
        Url="'installation folder'\Common7\IDE\PrivateAssemblies\MyCustomAssembly.dll" />...

Now, something doesn't feel right. I don't know much about CAS, but it seems to me that the configuration above is risky. The custom assembly doesn't appear to be signed and I'm thinking maybe it could be possible for an attacker to replace it with whatever malicious assembly or for a careless developer on MyCustomAssembly to wreak havoc the system, even unintentionally (FullTrust).

Is the configuration above safe in production? If not, what are the risks and how can we do what i'm trying to do in a safe way? I'm thinking of things like using Assert in the custom assembly and granting it just the necessary permissions, giving the assembly a strong name, etc... but not sure how to do it...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.