SecurityException in dialog

[David Thielen]

Hi;

I have a C# Word Add-in (not VSTO) and I have the following problem:

In a menu event handler I can call:
Path.GetTempPath();
Process.Start(filename);

But when in that event handler I create a Form (dialog box) and call
Form.ShowDialog() to run it, then in a delegate inside the dialog box code -
called via BeginInvoke - making those two calls causes a SecurityException.

I can open a file, write to it, and close it.

And the exception lists mscoree.dll as the cause, not my dll.

Any ideas???

 

[Peter Huang [MSFT]]

Hi

Based on my test, I can not reproduce the problem.
Here is my reproduce code.
[Form code]
private void TestPermission()
{
MessageBox.Show(Path.GetTempPath());
MessageBox.Show(Environment.GetEnvironmentVariable("TEMP"));
System.Diagnostics.Process.Start("notepad.exe");
}
delegate void dgMethod();
private void button1_Click(object sender, System.EventArgs e)
{
MessageBox.Show("Begin Invoke");
BeginInvoke(new dgMethod(TestPermission));
}


[C# Addin code]
public void OnStartupComplete(ref System.Array custom)
{
cb = wdApp.CommandBars.Add("TestToolbar",oMissing,oMissing,true);
cbb =
(CommandBarButton)cb.Controls.Add(MsoControlType.msoControlButton,oMissing,o
Missing,oMissing,true);
cbb.Caption = "Test";
cbb.Click+=new _CommandBarButtonEvents_ClickEventHandler(cbb_Click);
}
public void OnBeginShutdown(ref System.Array custom)
{
}
object oMissing = System.Reflection.Missing.Value;
CommandBar cb=null;
CommandBarButton cbb =null;
private Word.Application wdApp=null;

private void cbb_Click(CommandBarButton Ctrl, ref bool CancelDefault)
{
Debug.WriteLine("Clicked");
Debug.WriteLine(Path.GetTempPath());
Form1 fm = new Form1();
fm.ShowDialog();
}

You may try my code to see if that works for you.
Also I think you may try to run the code on another machine to see if that
works for you.

Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[David Thielen]

Hi;

First off, your example works. The problem here is complex. Here is the call
sequence and where I can call Path.GetTempPath(). This is all in a Word
Add-in in C# (not VSTO).

Menu event handler is called – GetTempPath succeeds
Creates dialog box, calls ShowDialog()
Dialog constructor called – GetTempPath succeeds
Dialog.Activated fires – GetTempPath succeeds

At this time I call a dll of mine built in a totally separate solution. This
performs a network call to a server and returns data. This set of events is:
Socket.BeginConnect(endpoint, ConnectCallback, socket);
ConnectCallback called – calls Socket.BeginSend(…,SendCallback,…);
SendCallback called – calls Socket.BeginReceive(…,ReceiveCallback,…);
At each point in the above calls, it calls a delegate in my dialog code to
give the status of the communication. When the receive is complete, the
dialog code calls:
BeginInvoke(new LaunchDelegate(LaunchReport));

And in the method LaunchReport – GetTempPath throws an exception.
Dialog.Closing fires (after the exception which is caught) – GetTempPath()
succeeds.

The call stack is:
autotag2003.dll!WindwardBear.SpawnReport.LaunchReport() Line 156 C#
[<Non-user Code>]
autotag2003.dll!WindwardBear.Framework.LaunchReport(string ext = "html")
Line 2175 + 0xb bytes C#
autotag2003.dll!WindwardBear.Framework.RunHtml_Click(Microsoft.Office.Core.CommandBarButton
Ctrl = {Microsoft.Office.Core.CommandBarButtonClass}, bool CancelDefault =
false) Line 2132 C#
[<Non-user Code>]

Because I am calling BeginInvoke, I am assuming the top <Non-user Code> is
Windows. But it is possible that it is my separate dll. Is there any way to
determine which it is?

If it is that dll, here are the assembly settings for the communications dll:
[assembly:CLSCompliant(true)]
[assembly:ComVisible(false)]
[assembly:SocketPermission(SecurityAction.RequestMinimum,
Unrestricted=true)]
[assemblynsPermission(SecurityAction.RequestMinimum, Unrestricted=true)]
[assembly:IsolatedStorageFilePermission(SecurityAction.RequestOptional,
UserQuota=1048576)]
[assembly:FileIOPermission(SecurityAction.RequestOptional, Unrestricted=true)]
[assembly:SecurityPermission(SecurityAction.RequestRefuse,
UnmanagedCode=true)]
[assembly:EnvironmentPermission(SecurityAction.RequestRefuse)]
[assembly:FileDialogPermission(SecurityAction.RequestRefuse)]
[assemblyublisherIdentityPermission(SecurityAction.RequestRefuse)]
[assembly:ReflectionPermission(SecurityAction.RequestRefuse)]
[assembly:RegistryPermission(SecurityAction.RequestRefuse)]
[assembly:SiteIdentityPermission(SecurityAction.RequestRefuse)]
[assembly:ZoneIdentityPermission(SecurityAction.RequestRefuse)]
[assembly:UIPermission(SecurityAction.RequestRefuse)]

My understanding of these settings is they affect my communications DLL
only. I don’t want to affect any other application that uses the
communication DLL – the intent of these settings is just to say that the
communication DLL does not need any of the above permissions.

The exception (ToString) is:
System.Security.SecurityException: Request for the permission of type
System.Security.Permissions.EnvironmentPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
at System.Security.PermissionListSet.CheckDemand(CodeAccessPermission
demand, PermissionToken permToken)
at System.Security.CodeAccessSecurityEngine.Check(PermissionToken
permToken, CodeAccessPermission demand, StackCrawlMark& stackMark, Int32
checkFrames, Int32 unrestrictedOverride)
at System.Security.CodeAccessSecurityEngine.Check(CodeAccessPermission
cap, StackCrawlMark& stackMark)
at System.Security.CodeAccessPermission.Demand()
at System.IO.Path.GetTempPath()
at WindwardBear.SpawnReport.LaunchReport() in
c:\\src\\autotag\\autotag2003\\spawnreport.cs:line 152"

thanks - dave

 

[Peter Huang [MSFT]]

Hi

The .NET CAS is walking through the stack. i.e. as long as one of the call
in the calling stack did not have the desired permission, the whole calling
stack will fail.
So I think you may try to check the walking stack to ensure all the caller
on the calling stack have the FileDialogPermission.

Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.