使用自定义解析器时，程序集不允许部分受信任的调用者

Question

I have an assembly on the intranet calling to another library on the intranet (in a different folder) which then calls Microsoft HPC API which is installed in the local machine GAC.

The assembly finds the library using the method in MS KB 837908 and in the process a SecurityException is raised "That assembly does not allow partially trusted callers" (That assembly is the HPC API)

However if I move the library in the same folder on the intranet as the executing assembly (ie. there is no need to call the custom resolver) it all works fine.

How can I improve the custom resolver to avoid this security exception?

Answer 1

a SecurityException is raised "That assembly does not allow partially trusted callers"

That's a good thing. If the assembly was not marked with the Allow Partially Trusted Callers attribute, that means that either (1) the authors of that assembly never performed a security review to see if it was safe to be called by hostile partially trusted code, or (2) did perform a security review, and did determine that the assembly was not safe to be called by hostile partially trusted code .

This exception is protecting your users from harm, and so you should be glad that it is thrown.

However if I move the library in the same folder on the intranet as the executing assembly it all works fine.

Well then, it sounds like you've solved your problem.

How can I improve the custom resolver to avoid this security exception?

You're asking how to work around a correctly-working security system that is protecting your users from attacks by hostile partially trusted code ? Why on earth would you want to do that? If you could do that successfully I hope you would tell Microsoft about it so that we could fix the bug and prevent you from doing that .

Do not work around security systems; work with security systems. If the problem is that you are calling a component that requires a fully trusted caller then either (1) don't call that component, or (2) instruct your users to set policies that fully trust the caller.

Answer 2

Hans Passant provided this solution in the comments , I've extended an offer to him to provide a formal answer and I'll be happy to accept it.

Using the Microsoft KB sample linked in question change

MyAssembly = Assembly.LoadFrom(strTempAssmbPath);

to

Assembly.LoadFrom(strTempAssmbPath, Assembly.GetExecutingAssembly().Evidence)