Some of the new features in SharePoint 2010 offer some great new opportunities for malicious scripts to be manipulated in your system. The new SharePoint 2010 Client Object Model is a great case in point.
Let's take the example where a contributor adds some Client Object Model scripts through exposed web Part properties to change list data that they don't have access to. As soon as someone with admin privileges visits the page that Client OM kicks off and you've got yourself malicious script executing!
Well, step in the new XSS protection. The WebPartPages class now includes a new attribute that you can add to your Web Part Properties called "RequiresDesignerPermissionAttribute". There is also a new SafeControl attribute called "SafeAgainstScript".
These allow you to protect your assemblies and properties against contributors. The main problem is that none of your MOSS 2007 web part properties will be accessible to contributors without these added!
This obviously creates quite an overhead in terms of code use, but it really is required to make sure that your web parts are running in an appropriately secure state.
No comments:
Post a Comment
This blog has been moved to www.martinhatch.com
Note: only a member of this blog may post a comment.