CAS issue accessing byte[] resource

[Guest]

Hi, I have a CAS problem related to a serialized object in a satellite
assembly.


Specifically, I have an application with one EXE and two DLLs on my server.
The EXE uses one of the DLLs, and that DLL uses the other DLL as a satellite
assembly (which contains an embedded resource).


It all works well on planet Earth, but when I try to launch the app. through
a "Smart Client".


[FYI I start the app from code on the client:


string strURL = "http://localhost/SmartServer/Bin/Debug/Smart.exe";


// Set the class to call
string sClassName = "MySmartClient.SmartForm";


Assembly assemblyContent = null;


try
{
// Load the assembly
assemblyContent = Assembly.LoadFrom(strURL);
}
catch(Exception e)
{
System.Windows.Forms.MessageBo­x.Show("Exception:
"+e.Message+"
\r\n"+e.StackTrace);
}
splash.Close();


// Create a object for the Class
Type typeContent = assemblyContent.GetType(sClass­Name);


// Invoke the method. Here we are invoking the Main method.
try
{


typeContent.InvokeMember ("Main", BindingFlags.Public |
BindingFlags.InvokeMethod | BindingFlags.Static,
null, null, null);
}
catch(Exception e)
{
System.Windows.Forms.MessageBo­x.Show("Exception2:
"+e.Message+"
\r\n"+e.StackTrace);
}


]


This works fine when I give the localhost zone full-trust, but fails on low
trust.


I've narrowed the issue down to the resource in the satellite assembly; the
main assembly needs to get a resource (byte array) from the assembly, which
it does with


ResourceManager rm = new ResourceManager(name,
Assembly.GetExecutingAssembly(­));
return (byte[])rm.GetObject(resourceO­bjectName);


This fails in low trust, because the code doesn't have permission to
deserialize the type (even though it's a harmless byte array ). I added
the assembly to the GAC and it did work, but that's not an acceptable
solution :[.


This all seems to be in-line with
http://www.thinktecture.com/Resources/RemotingFAQ/Changes2003.html, but I'm
afraid I don't see how to apply that to this situation. I keep seeing
samples posted as solutions with


BinaryServerFormatterSinkProvi­der serverProv = new
BinaryServerFormatterSinkProvi­der();
serverProv.TypeFilterLevel =
System.Runtime.Serialization.F­ormatters.TypeFilterLevel.Full­;


BinaryClientFormatterSinkProvi­der clientProv = new
BinaryClientFormatterSinkProvi­der();


IDictionary props = new Hashtable();
props["port"] = 1234;


HttpChannel chan = new HttpChannel(props, clientProv, serverProv);

ChannelServices.RegisterChanne­l( chan );


but what does it mean? What port am I supposed to provide (80?)? And where
does this go, client or server?


Can someone please help, preferably without configuration file changes.


Thanks!


Jim

 

[Peter Huang [MSFT]]

Hi

Based on my knowledge, when you load it from the URL, it is running in the
sandbox which have lower permission. This is for security purpose.
The scenario is similar with a satellite assembly need to read a local
file, but it did not have permisson.

For your scenario, I think you may try to add a strongnamed code group for
the problem assembly to ensure it have the needed permisson.
Running Secure Mobile Code
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dv_vstechar
t/html/vbcodeaccess.asp

Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.