|
1 | 1 | --- |
2 | 2 | title: "CA2117: APTCA types should only extend APTCA base types | Microsoft Docs" |
3 | | -ms.custom: "" |
4 | 3 | ms.date: "11/04/2016" |
5 | | -ms.reviewer: "" |
6 | | -ms.suite: "" |
7 | | -ms.technology: |
8 | | - - "vs-ide-code-analysis" |
9 | | -ms.tgt_pltfrm: "" |
| 4 | +ms.technology: vs-ide-code-analysis |
10 | 5 | ms.topic: "article" |
11 | | -f1_keywords: |
| 6 | +f1_keywords: |
12 | 7 | - "CA2117" |
13 | 8 | - "AptcaTypesShouldOnlyExtendAptcaBaseTypes" |
14 | | -helpviewer_keywords: |
| 9 | +helpviewer_keywords: |
15 | 10 | - "AptcaTypesShouldOnlyExtendAptcaBaseTypes" |
16 | 11 | - "CA2117" |
17 | 12 | ms.assetid: c505b586-2f1e-47cb-98ee-a5afcbeda70f |
18 | | -caps.latest.revision: 16 |
19 | 13 | author: "gewarren" |
20 | 14 | ms.author: "gewarren" |
21 | 15 | manager: ghogen |
22 | | -ms.workload: |
| 16 | +ms.workload: |
23 | 17 | - "multiple" |
24 | 18 | --- |
25 | 19 | # CA2117: APTCA types should only extend APTCA base types |
26 | | -||| |
27 | | -|-|-| |
28 | | -|TypeName|AptcaTypesShouldOnlyExtendAptcaBaseTypes| |
29 | | -|CheckId|CA2117| |
30 | | -|Category|Microsoft.Security| |
31 | | -|Breaking Change|Breaking| |
32 | | - |
33 | | -## Cause |
34 | | - A public or protected type in an assembly with the <xref:System.Security.AllowPartiallyTrustedCallersAttribute?displayProperty=fullName> attribute inherits from a type declared in an assembly that does not have the attribute. |
35 | | - |
36 | | -## Rule Description |
37 | | - By default, public or protected types in assemblies with strong names are implicitly protected by an <xref:System.Security.Permissions.SecurityAction.InheritanceDemand> for full trust. Strong-named assemblies marked with the <xref:System.Security.AllowPartiallyTrustedCallersAttribute> (APTCA) attribute do not have this protection. The attribute disables the inheritance demand. This makes exposed types declared in the assembly inheritable by types that do not have full trust. |
38 | | - |
39 | | - When the APTCA attribute is present on a fully trusted assembly, and a type in the assembly inherits from a type that does not allow partially trusted callers, a security exploit is possible. If two types `T1` and `T2` meet the following conditions, malicious callers can use the type `T1` to bypass the implicit full trust inheritance demand that protects `T2`: |
40 | | - |
41 | | -- `T1` is a public type declared in a fully trusted assembly that has the APTCA attribute. |
42 | | - |
43 | | -- `T1` inherits from a type `T2` outside its assembly. |
44 | | - |
45 | | -- `T2`'s assembly does not have the APTCA attribute and, therefore, should not be inheritable by types in partially trusted assemblies. |
46 | | - |
47 | | - A partially trusted type `X` can inherit from `T1`, which gives it access to inherited members declared in `T2`. Because `T2` does not have the APTCA attribute, its immediate derived type (`T1`) must satisfy an inheritance demand for full trust; `T1` has full trust and therefore satisfies this check. The security risk is because `X` does not participate in satisfying the inheritance demand that protects `T2` from untrusted subclassing. For this reason, types with the APTCA attribute must not extend types that do not have the attribute. |
48 | | - |
49 | | - Another security issue, and perhaps a more common one, is that the derived type (`T1`) can, through programmer error, expose protected members from the type that requires full trust (`T2`). When this occurs, untrusted callers gain access to information that should be available only to fully trusted types. |
50 | | - |
51 | | -## How to Fix Violations |
52 | | - If the type reported by the violation is in an assembly that does not require the APTCA attribute, remove it. |
53 | | - |
54 | | - If the APTCA attribute is required, add an inheritance demand for full trust to the type. This protects against inheritance by untrusted types. |
55 | | - |
56 | | - It is possible to fix a violation by adding the APTCA attribute to the assemblies of the base types reported by the violation. Do not do this without first conducting an intensive security review of all code in the assemblies and all code that depends on the assemblies. |
57 | | - |
58 | | -## When to Suppress Warnings |
59 | | - To safely suppress a warning from this rule, you must ensure that protected members exposed by your type do not directly or indirectly allow untrusted callers to access sensitive information, operations, or resources that can be used in a destructive manner. |
60 | | - |
61 | | -## Example |
62 | | - The following example uses two assemblies and a test application to illustrate the security vulnerability detected by this rule. The first assembly does not have the APTCA attribute and should not be inheritable by partially trusted types (represented by `T2` in the previous discussion). |
63 | | - |
64 | | - [!code-csharp[FxCop.Security.NoAptcaInherit#1](../code-quality/codesnippet/CSharp/ca2117-aptca-types-should-only-extend-aptca-base-types_1.cs)] |
65 | | - |
66 | | -## Example |
67 | | - The second assembly, represented by `T1` in the previous discussion, is fully trusted and allows partially trusted callers. |
68 | | - |
69 | | - [!code-csharp[FxCop.Security.YesAptcaInherit#1](../code-quality/codesnippet/CSharp/ca2117-aptca-types-should-only-extend-aptca-base-types_2.cs)] |
70 | | - |
71 | | -## Example |
72 | | - The test type, represented by `X` in the previous discussion, is in a partially trusted assembly. |
73 | | - |
74 | | - [!code-csharp[FxCop.Security.TestAptcaInherit#1](../code-quality/codesnippet/CSharp/ca2117-aptca-types-should-only-extend-aptca-base-types_3.cs)] |
75 | | - |
76 | | - This example produces the following output. |
77 | | - |
78 | | - **Meet at the shady glen 2/22/2003 12:00:00 AM!** |
79 | | -**From Test: sunny meadow** |
80 | | -**Meet at the sunny meadow 2/22/2003 12:00:00 AM!** |
81 | | -## Related Rules |
82 | | - [CA2116: APTCA methods should only call APTCA methods](../code-quality/ca2116-aptca-methods-should-only-call-aptca-methods.md) |
83 | | - |
84 | | -## See Also |
85 | | - [Secure Coding Guidelines](/dotnet/standard/security/secure-coding-guidelines) |
86 | | - [Using Libraries from Partially Trusted Code](/dotnet/framework/misc/using-libraries-from-partially-trusted-code) |
| 20 | + |
| 21 | +||| |
| 22 | +|-|-| |
| 23 | +|TypeName|AptcaTypesShouldOnlyExtendAptcaBaseTypes| |
| 24 | +|CheckId|CA2117| |
| 25 | +|Category|Microsoft.Security| |
| 26 | +|Breaking Change|Breaking| |
| 27 | + |
| 28 | +## Cause |
| 29 | + |
| 30 | +A public or protected type in an assembly with the <xref:System.Security.AllowPartiallyTrustedCallersAttribute?displayProperty=fullName> attribute inherits from a type declared in an assembly that does not have the attribute. |
| 31 | + |
| 32 | +## Rule Description |
| 33 | + |
| 34 | +By default, public or protected types in assemblies with strong names are implicitly protected by an [InheritanceDemand](xref:System.Security.Permissions.SecurityAction#System_Security_Permissions_SecurityAction_InheritanceDemand) for full trust. Strong-named assemblies marked with the <xref:System.Security.AllowPartiallyTrustedCallersAttribute> (APTCA) attribute do not have this protection. The attribute disables the inheritance demand. Exposed types declared in an assembly without an inheritance demand are inheritable by types that do not have full trust. |
| 35 | + |
| 36 | +When the APTCA attribute is present on a fully trusted assembly, and a type in the assembly inherits from a type that does not allow partially trusted callers, a security exploit is possible. If two types `T1` and `T2` meet the following conditions, malicious callers can use the type `T1` to bypass the implicit full trust inheritance demand that protects `T2`: |
| 37 | + |
| 38 | +- `T1` is a public type declared in a fully trusted assembly that has the APTCA attribute. |
| 39 | + |
| 40 | +- `T1` inherits from a type `T2` outside its assembly. |
| 41 | + |
| 42 | +- `T2`'s assembly does not have the APTCA attribute and, therefore, should not be inheritable by types in partially trusted assemblies. |
| 43 | + |
| 44 | +A partially trusted type `X` can inherit from `T1`, which gives it access to inherited members declared in `T2`. Because `T2` does not have the APTCA attribute, its immediate derived type (`T1`) must satisfy an inheritance demand for full trust; `T1` has full trust and therefore satisfies this check. The security risk is because `X` does not participate in satisfying the inheritance demand that protects `T2` from untrusted subclassing. For this reason, types with the APTCA attribute must not extend types that do not have the attribute. |
| 45 | + |
| 46 | +Another security issue, and perhaps a more common one, is that the derived type (`T1`) can, through programmer error, expose protected members from the type that requires full trust (`T2`). When this exposure occurs, untrusted callers gain access to information that should be available only to fully trusted types. |
| 47 | + |
| 48 | +## How to Fix Violations |
| 49 | + |
| 50 | +If the type reported by the violation is in an assembly that does not require the APTCA attribute, remove it. |
| 51 | + |
| 52 | +If the APTCA attribute is required, add an inheritance demand for full trust to the type. The inheritance demand protects against inheritance by untrusted types. |
| 53 | + |
| 54 | +It is possible to fix a violation by adding the APTCA attribute to the assemblies of the base types reported by the violation. Do not do this without first conducting an intensive security review of all code in the assemblies and all code that depends on the assemblies. |
| 55 | + |
| 56 | +## When to Suppress Warnings |
| 57 | + |
| 58 | +To safely suppress a warning from this rule, you must ensure that protected members exposed by your type do not directly or indirectly allow untrusted callers to access sensitive information, operations, or resources that can be used in a destructive manner. |
| 59 | + |
| 60 | +## Example |
| 61 | + |
| 62 | +The following example uses two assemblies and a test application to illustrate the security vulnerability detected by this rule. The first assembly does not have the APTCA attribute and should not be inheritable by partially trusted types (represented by `T2` in the previous discussion). |
| 63 | + |
| 64 | +[!code-csharp[FxCop.Security.NoAptcaInherit#1](../code-quality/codesnippet/CSharp/ca2117-aptca-types-should-only-extend-aptca-base-types_1.cs)] |
| 65 | + |
| 66 | +The second assembly, represented by `T1` in the previous discussion, is fully trusted and allows partially trusted callers. |
| 67 | + |
| 68 | +[!code-csharp[FxCop.Security.YesAptcaInherit#1](../code-quality/codesnippet/CSharp/ca2117-aptca-types-should-only-extend-aptca-base-types_2.cs)] |
| 69 | + |
| 70 | +The test type, represented by `X` in the previous discussion, is in a partially trusted assembly. |
| 71 | + |
| 72 | +[!code-csharp[FxCop.Security.TestAptcaInherit#1](../code-quality/codesnippet/CSharp/ca2117-aptca-types-should-only-extend-aptca-base-types_3.cs)] |
| 73 | + |
| 74 | +This example produces the following output: |
| 75 | + |
| 76 | +**Meet at the shady glen 2/22/2003 12:00:00 AM!** |
| 77 | + |
| 78 | +**From Test: sunny meadow** |
| 79 | + |
| 80 | +**Meet at the sunny meadow 2/22/2003 12:00:00 AM!** |
| 81 | + |
| 82 | +## Related Rules |
| 83 | + |
| 84 | +[CA2116: APTCA methods should only call APTCA methods](../code-quality/ca2116-aptca-methods-should-only-call-aptca-methods.md) |
| 85 | + |
| 86 | +## See also |
| 87 | + |
| 88 | +- [Secure Coding Guidelines](/dotnet/standard/security/secure-coding-guidelines) |
| 89 | +- [Using Libraries from Partially Trusted Code](/dotnet/framework/misc/using-libraries-from-partially-trusted-code) |
0 commit comments