The strange case of the missing ExportedTypes

Recently I came across a strange error when trying to load an assembly into a Code Access Security (CAS) sandbox with C# (in a .NET 4.6.2 environment). I received a SecurityException with the dreaded Request failed. message when trying to access the ExportedTypes property on my assembly – something I would not think is possible as the actual loading of the assembly was successful.

A closer look with the debugger revealed the following:

Assembly.ExportedTypes Exception

Assembly.ExportedTypes Exception

As we know, SecurityExceptions are not the most obvious to debug or analyse, but I could narrow down the problem by creating a fresh and empty assembly and subsequently adding types until the error ocurred.

The sandbox I was using (and which had been working for months) set Execution and SerializationFormatter permissoins on the AppDomain and used a set of full trusted assemblies that could be accessed from within the sandbox. One of the interfaces IBaseBehaviour was used to define a class inside the sandbox and derived from System.Runtime.Serialization.ISerializable:

// trusted assembly

[assembly: SecurityRules(SecurityRuleSet.Level2)]
[assembly: AllowPartiallyTrustedCallers] // APTCA

namespace Net.Appclusive.Public.Engine
{
  public interface IBaseBehaviour : ISerializable
  {
    // ...
  }

  public class BaseModel : IBaseBehaviour, ISerializable
  {
    // ...
  }
}

The class SquareModel that generated the error derived from IBaseBehaviour and therefore also had to implement ISerializable (via BaseModel that also resided in the fully trusted assembly):

// sandboxed assembly

namespace Org.Sharedop.Model
{
  public class SquareModel : BaseModel, IBaseBehaviour
  {
    // ...
  }
}

As soon as I removed the ISerializable interface from IBaseBehaviour (but leaving it on BaseModel) things started working again.

Though I got it working I am not totally happy as these questions have been left unanswered:

  1. Why leads implementing an interface that in turn implements ISerializable to an error, but deriving from a class that implements ISerializable does not?
  2. Why is Assembly.Load successful but accessing (the essential) ExportedTypes property throws a SecurityEception?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: