The assembly does not allow partially trusted subscribers when using a custom converter

Question

I have an assembly on the intranet that calls another library on the intranet (in a different folder), which then calls the Microsoft HPC API, which is installed on the local GAC computer.

The assembly finds the library using the method in MS KB 837908 , and a SecurityException is thrown. This assembly does not allow partial trust of callers "(this assembly is the HPC API)

However, if I move the library in the same folder on the intranet as the executing assembly (i.e. there is no need to call the custom converter), everything works fine.

How can I improve a custom converter to avoid this security exception?

Answer 1

Hans Passant provided this solution in the comments , I invited him to provide an official response, and I will be happy to accept it.

Using a Microsoft KB sample related to a question change

MyAssembly = Assembly.LoadFrom(strTempAssmbPath); 

to

 Assembly.LoadFrom(strTempAssmbPath, Assembly.GetExecutingAssembly().Evidence) 

Answer 2

throws a SecurityException "This assembly does not allow partially trusted subscribers"

This is a good thing. If the assembly was not marked with the “Allow partially trusted callers” attribute, this means that either (1) the authors of this assembly never performed a security check to ensure that it could be called by a hostile partially trusted code, or (2) performed a check security and determined that the assembly is not safe to call using hostile partially trusted code.

This exception protects your users from harm, and therefore you should be glad that you left it.

However, if I move the library to the same folder on the intranet as the running assembly, everything works fine.

So it looks like you solved your problem.

How can I improve a custom converter to avoid this security exception?

Are you asking how to work with a properly functioning security system that protects your users from attacks with hostile partially trusted code ? Why do you want to do this? If you could do it successfully, I hope you tell Microsoft about it so that we can fix the error and prevent you from doing this.

Do not work with security systems; work with security systems. If the problem is that you are invoking a component that requires a fully trusted caller, either (1) do not invoke that component, or (2) instruct your users to set policies that fully trust the caller.