订阅域事件时，C# AppDomain沙盒安全性异常

Question

我正在编写一个插件系统，用于在我的服务器应用程序（C＃，.NET 4.0）中运行客户提供的不受信任的代码。为此，我在一个新的沙箱AppDomain中运行每个插件。

然而，我遇到了一个安全异常，我真的不理解原因。我已经准备了一个简化的控制台应用程序示例来说明问题：

namespace SandboxTest
{
    class Program
    {
        static void Main( string[] args )
        {
            Sandbox sandbox = new Sandbox();
            Console.ReadLine();
        }
    }

    class Sandbox
    {
        AppDomain domain;

        public Sandbox()
        {
            PermissionSet ps = new PermissionSet( PermissionState.None );
            ps.AddPermission( new SecurityPermission( SecurityPermissionFlag.Execution ) );

            try
            {
                domain = AppDomain.CreateDomain( "Sandbox", AppDomain.CurrentDomain.Evidence, AppDomain.CurrentDomain.SetupInformation, ps );
                domain.AssemblyLoad += new AssemblyLoadEventHandler( domain_AssemblyLoad );
                domain.AssemblyResolve += new ResolveEventHandler( domain_AssemblyResolve );
            }
            catch( Exception e )
            {
                Trace.WriteLine( e.ToString() );
                throw e;
            }
        }

        static Assembly domain_AssemblyResolve( object sender, ResolveEventArgs args )
        {
            return null;
        }

        static void domain_AssemblyLoad( object sender, AssemblyLoadEventArgs args )
        {

        }
    }
}

运行此代码后，在domain.AssemblyLoad行上出现以下异常：

A first chance exception of type 'System.Security.SecurityException' occurred in SandboxTest.exe
'SandboxTest.vshost.exe' (Managed (v4.0.30319)): Loaded 'C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll', Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.ReflectionPermission, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
   at System.Security.CodeAccessSecurityEngine.ThrowSecurityException(RuntimeAssembly asm, PermissionSet granted, PermissionSet refused, RuntimeMethodHandleInternal rmh, SecurityAction action, Object demand, IPermission permThatFailed)
   at System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Object assemblyOrString, PermissionSet granted, PermissionSet refused, RuntimeMethodHandleInternal rmh, SecurityAction action, Object demand, IPermission permThatFailed)
   at System.Security.CodeAccessSecurityEngine.CheckHelper(PermissionSet grantedSet, PermissionSet refusedSet, CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh, Object assemblyOrString, SecurityAction action, Boolean throwException)
   at System.Security.CodeAccessSecurityEngine.CheckHelper(CompressedStack cs, PermissionSet grantedSet, PermissionSet refusedSet, CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh, RuntimeAssembly asm, SecurityAction action)
   at System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet)
   at System.Security.CodeAccessSecurityEngine.Check(CodeAccessPermission cap, StackCrawlMark& stackMark)
   at System.Security.CodeAccessPermission.Demand()
   at System.DelegateSerializationHolder.GetDelegateSerializationInfo(SerializationInfo info, Type delegateType, Object target, MethodInfo method, Int32 targetIndex)
   at System.MulticastDelegate.GetObjectData(SerializationInfo info, StreamingContext context)
   at System.Runtime.Serialization.ObjectCloneHelper.GetObjectData(Object serObj, String& typeName, String& assemName, String[]& fieldNames, Object[]& fieldValues)


   at System.AppDomain.add_AssemblyLoad(AssemblyLoadEventHandler value)
   at SandboxTest.Sandbox..ctor() in C:\Dev\Projects\Botfield\SandboxTest\Program.cs:line 36
The action that failed was:
Demand
The type of the first permission that failed was:
System.Security.Permissions.ReflectionPermission
The first permission that failed was:
<IPermission class="System.Security.Permissions.ReflectionPermission, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Flags="MemberAccess"/>

The demand was for:
<IPermission class="System.Security.Permissions.ReflectionPermission, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Flags="MemberAccess"/>

The granted set of the failing assembly was:
<PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.SecurityPermission, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Flags="Execution"/>
</PermissionSet>

我最好的猜测是，在新的沙盒化AppDomain中执行了一些事件订阅代码，但缺少必要的安全权限。但我不知道如何解决这个问题，而不需要给予沙盒化AppDomain完全的反射能力。请问有人有建议或解释吗？

- Bugfoot

Answer 1

简短回答:

添加处理程序到事件AppDomain.AssemblyLoad的隐藏方法 - 由SecurityCriticalAttribute标记。检查ILASM:

.method public hidebysig newslot specialname virtual final 
        instance void  add_AssemblyLoad(class System.AssemblyLoadEventHandler 'value') cil managed
{
  .custom instance void System.Security.SecurityCriticalAttribute::.ctor() = ( 01 00 00 00 ) 
  // Code size       0 (0x0)
} // end of method AppDomain::add_AssemblyLoad

为了执行这个方法，你必须在 FullTrust 模式下执行（在你的沙盒域中）。没有其他选择。

长话短说，你正在处理跨域通信。这意味着你的事件处理程序将在沙盒域的空间中执行，然后使用远程连接到达父域。你提供的代码需要反射权限，无论你在该方法中使用的是安全关键事件还是非安全关键事件都不重要。

因此，如果你希望你的沙盒域与你的父域进行安全通信，你应该使用经典 .NET Remoting 方法，这段代码不需要任何额外的权限，并允许通知父域有关沙盒域中发生的事件。

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Security;
using System.Security.Permissions;
using System.Diagnostics;
using System.Reflection;

namespace SandboxTest
{
    class Program
    {
        static void Main(string[] args)
        {
            Sandbox sandbox = new Sandbox();
            Console.ReadLine();
        }
    }

    class Sandbox
    {
        AppDomain domain;

        public Sandbox()
        {
            PermissionSet ps = new PermissionSet(PermissionState.None);
            ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));

            try
            {
                domain = AppDomain.CreateDomain("Sandbox", AppDomain.CurrentDomain.Evidence, AppDomain.CurrentDomain.SetupInformation, ps);
                var tp = typeof(MyInit);

                var obj = (MyInit)domain.CreateInstanceAndUnwrap(tp.Assembly.FullName, tp.FullName);
                var myCallBack = new MyCallBack();
                myCallBack.Generated += new EventHandler(myCallBack_Generated);
                obj.Subscribe(myCallBack);
                obj.GenerateCallBackEvent();
            }
            catch (Exception e)
            {
                Trace.WriteLine(e.ToString());
                throw e;
            }
        }

        void myCallBack_Generated(object sender, EventArgs e)
        {
            //Executed in parent domain
        }



    }


    public class MyCallBack:MarshalByRefObject
    {
        public void GenerateEvent()
        {
            //Executed in parent domain, but triggered by sandbox domain
            if (Generated != null) Generated(this, null);
        }

        //for parent domain only
        public event EventHandler Generated;
    }

    public class MyInit:MarshalByRefObject
    {
        public MyInit()
        {

        }
        MyCallBack callback;
        public void Subscribe(MyCallBack callback)
        {
            //executed on sandbox domain
            this.callback = callback;
        }

        public void GenerateCallBackEvent()
        {
            //executed on sandbox domain
            callback.GenerateEvent();
        }


    }
}

- Philipp Munin