Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

what does this security warning mean (.Net Process class)?

I am using VSTS 2008 + .Net 2.0 + C#. And I am running Code Analysis after build. I got the following confusing security warning. Here is the warning and related code, any ideas what is wrong? If there is security warning, how to fix it?

System.Diagnostics.Process myProcess = new System.Diagnostics.Process();
myProcess.StartInfo.FileName = "IExplore.exe";
myProcess.StartInfo.Arguments = @"default.html";
myProcess.StartInfo.Verb = "runas";
myProcess.Start();

warning : CA2122 : Microsoft.Security : 'TestHtml()' calls into 'Process.Start()' which has a LinkDemand. By making this call, 'Process.Start()' is indirectly exposed to user code. Review the following call stack that might expose a way to circumvent security protection:

like image 731
George2 Avatar asked Jul 18 '09 10:07

George2


1 Answers

Your method calls Foo that calls into a Process.Start which is protected by a link demand for Full Trust. In order to avoid the problem that FxCop is warning you about, you should add a link demand or full demand for the same permissions to your method.

You can fix it by adding to your method

[PermissionSetAttribute(SecurityAction.LinkDemand, Name="FullTrust")]

See http://msdn.microsoft.com/en-us/library/970x52db.aspx

like image 51
blowdart Avatar answered Nov 10 '22 00:11

blowdart