Security issue with Assembly in GAC and ASP.NET run-time

[JamesMason]

I have an Assembly I've built and installed in the Global Assembly
Cache. I have an ASP.NET web application that is referencing this
Assembly and when I try to run it I get a "Parser Error: File or
assembly name LocalLib.Common, or one of its dependencies, was not
found."

The trace provides some interesting clues, it reads as follows:

=== Pre-bind state information ===
LOG: DisplayName = LocalLib.Common
(Partial)
LOG: Appbase = file:///c:/inetpub/wwwroot/IPDHome
LOG: Initial PrivatePath = bin
Calling assembly : (Unknown).
===

LOG: Policy not being applied to reference at this time (private,
custom, partial, or location-based assembly bind).
----------------------------------------------------------------------------

This appears to be a secuirty issue to me. The web application is
running under the aspnet account and this account has read/write
permissions on the \WINDOWS\Assembly folder.

I've run the Assembly Binding Log Viewer (fuslogvw.exe) utility and it
registers nothing when this app runs (and fails), there is no entry.

Does anyone know why this might be happening?

Best Regards,
James.

[Andrea D'Onofrio]

If you are using this component from inline code (inside the aspx page), you
MUST add the <add assembly="..." /> in the web.config file.

HtH
Andrea

"JamesMason" <jmason@funnydelight.co.uk> wrote in message
news:d4e30081.0311241317.3cec66b3@posting.google.c om...

> I have an Assembly I've built and installed in the Global Assembly
> Cache. I have an ASP.NET web application that is referencing this
> Assembly and when I try to run it I get a "Parser Error: File or
> assembly name LocalLib.Common, or one of its dependencies, was not
> found."
>
> The trace provides some interesting clues, it reads as follows:
>
> === Pre-bind state information ===
> LOG: DisplayName = LocalLib.Common
> (Partial)
> LOG: Appbase = file:///c:/inetpub/wwwroot/IPDHome
> LOG: Initial PrivatePath = bin
> Calling assembly : (Unknown).
> ===
>
> LOG: Policy not being applied to reference at this time (private,
> custom, partial, or location-based assembly bind).
> --------------------------------------------------------------------------

--

>
> This appears to be a secuirty issue to me. The web application is
> running under the aspnet account and this account has read/write
> permissions on the \WINDOWS\Assembly folder.
>
> I've run the Assembly Binding Log Viewer (fuslogvw.exe) utility and it
> registers nothing when this app runs (and fails), there is no entry.
>
> Does anyone know why this might be happening?
>
> Best Regards,
> James.

[JamesMason]

Hello Andrea,

I tried adding this entry into my web.config:
<configuration>
<system.web>
<compilation defaultLanguage="c#" debug="false">
<assemblies>
<add assembly="LocalLib.Common,
Version=1.0.0.0,
Culture=neutral,
PublicKeyToken=cab7b38fd4d97938" />
</assemblies>
</compilation>
....

It continues to fail, but this time with a "Parser Error Message: File
or assembly name LocalLib.Common, or one of its dependencies, was not
found."

The trace on this error is identical to the one on my top post.

One thing I've noticed that may be a problem, when I browse my Global
Assembly Cache and locate LocalLib.Common, its CodeBase attribute
reads:
file:///c:/code/rangersec/locallib.common/bin/release/

This is the path I ran gacutil -i from. But I've noticed none of the
other Assemblies in the GAC have an entry for CodeBase most of them
are blank. I don't know why this would be a problem as I've given the
"Everyone" group FullControl on
/code/rangersec/locallib.common/bin/release/ just to make sure this
wasn't a NTFS security issue, but it continues to fail at run-time.




"Andrea D'Onofrio" <andreado@microsoft.com> wrote in message news:<e4VaH6AtDHA.2308@TK2MSFTNGP11.phx.gbl>...

> If you are using this component from inline code (inside the aspx page), you
> MUST add the <add assembly="..." /> in the web.config file.
>
> HtH
> Andrea
>
> "JamesMason" <jmason@funnydelight.co.uk> wrote in message
> news:d4e30081.0311241317.3cec66b3@posting.google.c om...

> > I have an Assembly I've built and installed in the Global Assembly
> > Cache. I have an ASP.NET web application that is referencing this
> > Assembly and when I try to run it I get a "Parser Error: File or
> > assembly name LocalLib.Common, or one of its dependencies, was not
> > found."
> >
> > The trace provides some interesting clues, it reads as follows:
> >
> > === Pre-bind state information ===
> > LOG: DisplayName = LocalLib.Common
> > (Partial)
> > LOG: Appbase = file:///c:/inetpub/wwwroot/IPDHome
> > LOG: Initial PrivatePath = bin
> > Calling assembly : (Unknown).
> > ===
> >
> > LOG: Policy not being applied to reference at this time (private,
> > custom, partial, or location-based assembly bind).
> > --------------------------------------------------------------------------

> --

> >
> > This appears to be a secuirty issue to me. The web application is
> > running under the aspnet account and this account has read/write
> > permissions on the \WINDOWS\Assembly folder.
> >
> > I've run the Assembly Binding Log Viewer (fuslogvw.exe) utility and it
> > registers nothing when this app runs (and fails), there is no entry.
> >
> > Does anyone know why this might be happening?
> >
> > Best Regards,
> > James.