Linkdemand warning in C #

Question

I am trying to get the version of Iexplorer.exe in my dll. However, I get this warning every time

Warning 1 CA2122: Microsoft.Security: 'ApCkr.IEavailable ()' calls in 'FileVersionInfo.FileMajorPart.get ()', which has LinkDemand. By making this call, "FileVersionInfo.FileMajorPart.get ()" is indirectly exposed to the user code. Check out the following call stack, which might reveal a way around security:

After the loads of searching on MSDN (security permissions) and falgs, I still can't figure out how to get rid of this error. I tried

SecurityPermission(SecurityAction.LinkDemand, Flags = SecurityPermissionFlag.UnmanagedCode)] 

But he couldn't make it work

Any help would be greatly appreciated

  #region IExplore public string IEavailable() { bool IEversion; FileVersionInfo.GetVersionInfo("C:\\program files\\\\Internet Explorer\\iexplore.exe"); FileVersionInfo myFileVersionInfo = FileVersionInfo.GetVersionInfo("C:\\program files\\\\Internet Explorer\\iexplore.exe"); int a = myFileVersionInfo.FileMajorPart; if (a < 8) { IEversion = false; } else { IEversion = true; } return IEversion.ToString(); } #endregion 

Answer 1

This is the link request attribute in the FileVersionInfo class that he is talking about:

 [PermissionSet(SecurityAction.LinkDemand, Name="FullTrust")] 

This is well documented in an MSDN article, but it is not always easy to overwrite an FxCop message. I personally find Reflector quite handy to sort this out.

The need for a link is a very cheap demand for runtime validation. It is executed at compile time only on time, only once and only checks the permissions of the immediate caller. A possible security leak is due to the fact that later your resource may be called by another code. Such code will not receive the same request, because your property does not have an attribute and it is already a fraction. You must apply the same security attribute.

This will only be a problem if such code works without FullTrust. It is difficult to come up with such a scenario, you will need to create your own sandbox and set your property on such a sandbox. In case you are wondering about the impact of security on the ability to check the version of a DLL: to know exactly which version of the DLL is used by the program, it is very important to determine the attack vector.

FxCop is not smart enough to detect such scenarios. It really is a tool that just emits warnings about things you might miss. And you probably did it. CAS is otherwise quite difficult to understand, I struggle very much. And everyone else, because of this, it is deprecated in .NET 4, replacing it with a syntax model for security. Wise move, security that is incomprehensible, unsafe.

Answer 2

This is not a mistake - this is a warning. The documentation explaining what LinkDemand is is here .