C#2.0 CA2123 and CA2122 ... Need Help to Resolve

Hi There

Apologies for posting such a dumb question but I my knowledge of security is amatuer and I need to deploy this project tomorrow with no security warnings ...

I am inheriting from DateTimePicker class to create a DateTimePicker
control with a configurable back colour. I got the original code from
http://dotnet.mvps.org/ then converted it to C# and it works OK in .NET
2.0 except for two warnings from CodeAnalysis:

CA2123 : Microsoft.Security : The virtual method
DateTimePicker.WndProc(Message­&):Void defined by type
'System.Windows.Forms.DateTime­Picker' and its override
ExtendedDateTimePicker.WndProc­(Message&):Void do not have the same
LinkDemand status. Add a LinkDemand where required.

CA2122 : Microsoft.Security :
ExtendedDateTimePicker.WndProc­(Message&):Void calls into
DateTimePicker.WndProc(Message­&):Void which has a LinkDemand. By making
this call, DateTimePicker.WndProc(Message­&):Void is indirectly exposed
to user code. Review the following call stack that might expose a way
to circumvent security protection:
->System.Windows.Forms.DateTim­ePicker.WndProc(System.Windows­.Forms.Message@)
: Void
->PickupBooking.ExtendedDateTi­mePicker.WndProc

I would greatly appreciate if anyone could show me how fix the warnings and/or point out some good .NET 2.0 resources for security novices.

Btw, my C# 2.0 code is below.

TIA
Bill

using System;
using System.Windows.Forms;
using System.ComponentModel;
using System.Drawing;

namespace PickupBooking
{
public class ExtendedDateTimePicker : DateTimePicker
{
private SolidBrush m_BackBrush;

[Browsable(true),
DesignerSerializationVisibilit­y(DesignerSerializationVisibil­ity.Visible)]

public override Color BackColor
{
get
{
return base.BackColor;
}
set
{
if (!(m_BackBrush == null))
{
m_BackBrush.Dispose();
}
base.BackColor = value;
m_BackBrush = new SolidBrush(this.BackColor);
this.Invalidate();
}
}

protected override void WndProc(ref Message m)
{
const Int32 WM_ERASEBKGND = 20;
if (m.Msg == WM_ERASEBKGND)
{
Graphics g = Graphics.FromHdc(m.WParam);
if (m_BackBrush == null)
{
m_BackBrush = new SolidBrush(this.BackColor);
}
g.FillRectangle(m_BackBrush, this.ClientRectangle);
g.Dispose();
}
else
{
base.WndProc(ref m);
}
}

protected override void Dispose(bool disposing)
{
if (disposing && !(m_BackBrush == null))
{
m_BackBrush.Dispose();
}
base.Dispose(disposing);
}
}

[3179 byte] By [orekin] at [2008-2-15]
# 1

You need to insure that permission to execute unmanaged code is granted. The Whidbey build of FxCop (1.32) provides a much more useful message than the v1.1 version (due to its more easily recovered declarative security metadata):

Add the following security attribute to ExtendedDateTimePicker.WndProc(Message&):Void in order to match a LinkDemand on base method DateTimePicker.WndProc(Message&):Void

[SecurityPermission(SecurityAction.LinkDemand, Flags = SecurityPermissionFlag.UnmanagedCode)]

Michael Fanning
VSTS Development: Code Analysis

MichaelFanning-MS at 2007-9-9 > top of Msdn Tech,Visual Studio Team System,Visual Studio Code Analysis and Code Metrics...
# 2
Thanks Michael, worked perfectly. If your feeling energetic I have posted a new question !?!

http://forums.microsoft.com/msdn/ShowPost.aspx?PostID=66323#66323

Cheers
Bill

orekin at 2007-9-9 > top of Msdn Tech,Visual Studio Team System,Visual Studio Code Analysis and Code Metrics...
# 3
Hey, Bill,

What's your FxCop question here? Generally speaking, catching all exceptions is not a very good idea. In this case, though, it's clear that the point of the sample is to bring down the process in the event that any exception whatsoever is raised.

Michael

MichaelFanning-MS at 2007-9-9 > top of Msdn Tech,Visual Studio Team System,Visual Studio Code Analysis and Code Metrics...
# 4
Cool, thanks Michael. Actually, the FxCop turned out to be easy, I just caught some more specific exceptions

Cheers
Bill

orekin at 2007-9-9 > top of Msdn Tech,Visual Studio Team System,Visual Studio Code Analysis and Code Metrics...

Visual Studio Team System

Site Classified