Security issue with Assembly in GAC and ASP.NET run-time

[JamesMason]

I have an Assembly I've built and installed in the Global Assembly
Cache. I have an ASP.NET web application that is referencing this
Assembly and when I try to run it I get a "Parser Error: File or
assembly name LocalLib.Common, or one of its dependencies, was not
found."

The trace provides some interesting clues, it reads as follows:

=== Pre-bind state information ===
LOG: DisplayName = LocalLib.Common
(Partial)
LOG: Appbase = file:///c:/inetpub/wwwroot/IPDHome
LOG: Initial PrivatePath = bin
Calling assembly : (Unknown).
===

LOG: Policy not being applied to reference at this time (private,
custom, partial, or location-based assembly bind).
----------------------------------------------------------------------------

This appears to be a secuirty issue to me. The web application is
running under the aspnet account and this account has read/write
permissions on the \WINDOWS\Assembly folder.

I've run the Assembly Binding Log Viewer (fuslogvw.exe) utility and it
registers nothing when this app runs (and fails), there is no entry.

Does anyone know why this might be happening?

Best Regards,
James.

 

[Andrea D'Onofrio]

If you are using this component from inline code (inside the aspx page), you
MUST add the <add assembly="..." /> in the web.config file.

HtH
Andrea

 

[JamesMason]

Hello Andrea,

I tried adding this entry into my web.config:
<configuration>
<system.web>
<compilation defaultLanguage="c#" debug="false">
<assemblies>
<add assembly="LocalLib.Common,
Version=1.0.0.0,
Culture=neutral,
PublicKeyToken=cab7b38fd4d97938" />
</assemblies>
</compilation>
....

It continues to fail, but this time with a "Parser Error Message: File
or assembly name LocalLib.Common, or one of its dependencies, was not
found."

The trace on this error is identical to the one on my top post.

One thing I've noticed that may be a problem, when I browse my Global
Assembly Cache and locate LocalLib.Common, its CodeBase attribute
reads:
file:///c:/code/rangersec/locallib.common/bin/release/

This is the path I ran gacutil -i from. But I've noticed none of the
other Assemblies in the GAC have an entry for CodeBase most of them
are blank. I don't know why this would be a problem as I've given the
"Everyone" group FullControl on
/code/rangersec/locallib.common/bin/release/ just to make sure this
wasn't a NTFS security issue, but it continues to fail at run-time.