.NET 指南：从通过不被信任的代码使用中排除类与成员

如本文所示，使用通过部分被信任的代码而被使用的声明来防止特殊的类与方法，包括属性与事件。通过把这些声明作用于一个类，你就可以把保护应用到它的所有方法、属性，以及事件；但是要注意的是，字段访问并没有通过安全声明而受到影响。但是同样要注意的是连接要求只有助于反向保护直接的调用者并且仍然会受到引诱攻击的影响。

在被强命名的汇编集中，LinkDemand 能够作用于所有公开可访问的方法、属性，以及事件来限制完全被信任的调用者对于它们的使用。要禁用这个特征，你就必须应用 AllowPartiallyTrustedCallersAttribute 特性。因此，明确地标记类来排除非被使用的调用者只对于非被标记的汇编集或者使用了这个特性的汇编集来说才是必需的；你能够使用这些声明来标记一个不打算为非被信任的调用者所使用的类型子集。

下列范例说明了如何防止通过非被信任的代码来使用类与成员。

关于公开的非被密封的类：

Visual Basic

<System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name := "FullTrust"), _ 
System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name := "FullTrust")>  _
Public Class CanDeriveFromMe
End Class

C#

[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name="FullTrust")]
[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name="FullTrust")]
public class CanDeriveFromMe
{
}

关于公开的被密封的类：

Visual Basic

<System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name := "FullTrust")>  _
NotInheritable Public Class CannotDeriveFromMe
End Class

C#

[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name="FullTrust")]
public sealed class CannotDeriveFromMe
{
}

关于公开的抽象类：

Visual Basic

<System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name := "FullTrust"), _
System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name := "FullTrust")>  _
MustInherit Public Class CannotCreateInstanceOfMe_CanCastToMe
End Class

C#

[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name="FullTrust")]
[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name="FullTrust")]
public abstract class CannotCreateInstanceOfMe_CanCastToMe{}

关于公开的虚拟功能：

Visual Basic

Class Base1 
<System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name:="FullTrust"), System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name:="FullTrust")> _
    Public Overridable Sub CanOverrideOrCallMe()
    End Sub 'CanOverrideOrCallMe
End Class 'Base1

C#

class Base1 
{
[System.Security.Permissions.PermissionSetAttribute(
System.Security.Permissions.SecurityAction.InheritanceDemand, Name="FullTrust")]
[System.Security.Permissions.PermissionSetAttribute(
System.Security.Permissions.SecurityAction.LinkDemand, Name="FullTrust")]
    public virtual void CanOverrideOrCallMe() {}
}

关于公开的抽象功能：

Visual Basic

MustInherit Class Base2
    <System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name:="FullTrust"), System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name:="FullTrust")> _
    Public Sub MustOverrideMe()
    End Sub
End Class 'Base2

C#

abstract class Base2{
[System.Security.Permissions.PermissionSetAttribute(
System.Security.Permissions.SecurityAction.InheritanceDemand, Name = "FullTrust")]
[System.Security.Permissions.PermissionSetAttribute(
System.Security.Permissions.SecurityAction.LinkDemand, Name = "FullTrust")]
public abstract void MustOverrideMe();
}

关于在基类不要求完整信任时的公开的重载功能：

Visual Basic

Class Derived
    Inherits Base1
<System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.Demand, Name:="FullTrust")> _
    Public Overrides Sub CanOverrideOrCallMe()
        MyBase.CanOverrideOrCallMe()
    End Sub 'CanOverrideOrCallMe
End Class '被派生

C#

class Derived : Base1
{   
[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.Demand, Name="FullTrust")]    
    public override void CanOverrideOrCallMe() 
    {
        base.CanOverrideOrCallMe();
    }
}

关于在基类要求完整信任时的公开的重载功能：

Visual Basic

Class Derived
    Inherits Base1
<System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name:="FullTrust")> _
    Public Overrides Sub CanOverrideOrCallMe()
        MyBase.CanOverrideOrCallMe()
    End Sub 'CanOverrideOrCallMe 
End Class '被派生

C#

class Derived : Base1
{   
[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name="FullTrust")]    
    public override void CanOverrideOrCallMe() 
    {
        base.CanOverrideOrCallMe();
    }
}

关于公开的接口：

Visual Basic

Public Interface ICanCastToMe
    <System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name:="FullTrust"), System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name:="FullTrust")> _
    Sub CanImplementMe()
End Interface 'ICanCastToMe
<System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name:="FullTrust"), System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name:="FullTrust")> _
Class Implemented
    Implements ICanCastToMe
    Public Sub CanImplementMe()
    End Sub 'CanImplementMe

C#

public interface ICanCastToMe 
{
[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name = "FullTrust")]
[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name = "FullTrust")]
void CanImplementMe();
}
[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.LinkDemand, Name = "FullTrust")]
[System.Security.Permissions.PermissionSetAttribute(System.Security.Permissions.SecurityAction.InheritanceDemand, Name = "FullTrust")]
class Implemented : ICanCastToMe
{
    public void CanImplementMe()
    {
    }
}