Skip to content

DevExpress-Examples/prevent-loading-untrusted-custom-assembly-in-ef-data-model-deprecated

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Files to look at:

How to prevent loading untrusted custom assembly in EF data model

Note

As you may already know, the WinForms Snap control and Snap Report API are now in maintenance support mode. No new features or capabilities are incorporated into these products. We recommend that you use DevExpress Reporting tool to generate, edit, print, and export your business reports/documents.

This example addresses securirty considerations that are specific to creating reports or loading report templates which are bound to Entity Framework data models contained in a compiled assembly. Before loading the data assembly you should have an option to perform a path check to ensure that an assembly is obtained from a trusted source and that the path length is within valid limits.

Description

Handle the DevExpressDataAccessEntityFrameworkEFDataSource.BeforeLoadCustomAssembly event to allow loading a custom assembly; if you do not handle this event, an attempt to load a custom assembly by the Entity Framework data source will throw the CustomAssemblyLoadingProhibitedException

When a report template is loading, the SnapControl creates a data source from the string serilalized in the .snx file. An attempt to load the Entity Framework data model fires the SnapControl.BeforeLoadCustomAssembly event. If the e.AllowLoading  property is set to true, the assembly is loaded. 

To demonstrate the behavior described above, run this example. On the first run it creates a complied assembly containing Entity Framework data model; subsequently it creates the template which contains a data source bound to the assembly.  To load the data-bound template, click the Load Template with Data button. The BeforeLoadCustomAssembly event handler prompts you for the e.AllowLoading value.

You can show the Browse button (hidden by default)  in the Data Access Wizard by toggling the Browse for Assembly switch in the Data Wizard Options group. Click Add New Data Source, select Entity Framework and browse for the EFDataModel.dll assembly located at the application executable path. When you click Open to load this assembly, provide the Wizard with the following connection string:

Data Source=(LocalDB)\MSSQLLocalDB;attachdbfilename=|DataDirectory|\Contacts.mdf;integrated security=True;