Microsoft Knowledge Base Article
This article contents is Microsoft Copyrighted material.
©2005-©2007 Microsoft Corporation. All rights reserved.
Terms
of Use |
Trademarks
Article ID: 831687 - Last Review: May 10, 2007 - Revision: 1.12
Description of the Type Filtering feature in the Microsoft .NET Framework
On This Page
SUMMARY
In the Microsoft .NET Framework 1.1, the Type Filtering
feature is included with the .NET Framework Remoting infrastructure. By default, Type Filtering is enabled. Type Filtering limits the type of
objects that a .NET Framework Remoting client can marshal to a .NET Framework Remoting server. Type Filtering prevents the server from deserializing instances of
common language runtime types that may serve as vectors of
attack.
There are two levels of Type Filtering, as follows:
- Full
- Low
By default, Type Filtering is set to the Low level. The Low level provides more stringent security restrictions than the Full level.
MORE INFORMATION
Any .NET Framework Remoting system that depends on run-time validation
must deserialize a remote stream to start using the stream. This dependency on run-time validation may be exploited
by malicious clients during serialization or during deserialization. The .NET
Framework 1.1 includes a new, constrained .NET Framework Remoting model. In the .NET Framework 1.1, the most
secure level of deserialization is set as the default level. However, you can still use a less
secure level in the .NET Framework 1.1. The difference in the .NET Framework Remoting security levels may break existing implementations of the .NET Framework Remoting models because the default behavior
in the .NET Framework 1.1 is different from the default behavior in the .NET Framework 1.0.
Side effects of the Type Filtering feature
The following table describes several of the side effects that may occur if the
typeFilterLevel property of the Type Filtering feature is set to the Low level:
Collapse this tableExpand this table
| Functionality | Side Effect |
| Expose a .NET Framework Remoting server with a method or with a member that takes
a delegate. | You can use delegates to call methods on other types of objects that
have the same signature. |
| Expose a .NET Framework Remoting server that has a method or a member that takes
a MarshalByRefObject type. | The serialized form of a MarshalByRefObject type contains a mutable URL. |
| Expose a .NET Framework Remoting server with a method or with a member that takes
an ISerializable type. | Deserialization of an ISerializable type causes the .NET Framework Remoting infrastructure to run the
code of the type. |
| Expose a .NET Framework Remoting server with a method or with a member that takes
a type from the Global Assembly Cache (GAC) on the server computer in an
assembly that does not have the AllowPartiallyTrustedCallers (APTCA) attribute. | A malicious user may know the types in the GAC. Therefore, you incur a potential risk if you use these types with a .NET Framework Remoting server. |
| Expose a .NET Framework Remoting server that enables remote clients to
register sponsors. | There is no limit to the number of sponsors that can
be registered. |
REFERENCES
The .NET Framework Remoting deserialization
For additional information about automatic deserialization in .NET Remoting (.NET Framework Developer's Guide), visit the following Microsoft Developer Network (MSDN) Web site:
The typeFilterLevel property
For additional information about the
BinaryServerFormatterSink.TypeFilterLevel
property, visit the following MSDN Web site:
For additional information about the
BinaryServerFormatterSinkProvider.TypeFilterLevel
property, visit the following MSDN Web site:
For additional information about the
SoapServerFormatterSink.TypeFilterLevel
property, visit the following MSDN Web site:
For additional information about the
SoapServerFormatterSinkProvider.TypeFilterLevel
property, visit the following MSDN Web site:
APPLIES TO
- Microsoft .NET Framework 1.1
- Microsoft .NET Framework 1.0
- Microsoft Visual Studio .NET 2003 Academic Edition
- Microsoft Visual Studio .NET 2003 Enterprise Architect
- Microsoft Visual Studio .NET 2003 Enterprise Developer
- Microsoft Visual Studio .NET 2002 Academic Edition
- Microsoft Visual Studio .NET 2002 Enterprise Architect
- Microsoft Visual Studio .NET 2002 Enterprise Developer
- Microsoft Visual Studio .NET 2002 Professional Edition
| kbinterop kbsecurityservices kbremoting kbserial kbinfo KB831687 |
Community Feedback System
Very often, it takes hours to solve a problem. Very often, you've looked high
and low, and have tried a lot of solutions. When you finally found it, chances
are, it was because someone else helped you. Here's your chance to give back.
Use our community feedback tool to let others know what worked for you and what
didn't.
Please also understand that the community feedback system is not warranted to be
correct, it's simply a system that we've built to let people try and help each
other. If something in a feedback response doesn't make sense to you, or you're
not comfortable making changes that the feedback talks about (like registry
edits), please consult a professional.
Thank you for using kbAlertz.com Feedback System.
-- Scott Cate
Be the first to leave feedback, to help others about this knowledge base
article.
(Optional) Name
(Optional)
Public URL Or Email
Comments
No
HTML -- Text Only Please