SXML Code Access Security (SCAS)

Release 1.1 - ...

The modules/security section declares the Security Zones in wich SXML instructions are executed.

The zones section could look like this:

XML	Copy Code
<!-- Define Security Zones--> <zones default="NoRisk"> <add name="NoRisk" description="Used for fields without any SXML"/> <add name="LowRisk" description="High security, low risk zone, used for most body fields"/> <add name="MediumRisk" inherits="LowRisk" description="Medium risk zone, used for application page body and normal translations"/> <add name="HighRisk" inherits="MediumRisk" description="Low security, high risk zone, used for rendertemplate body and system translations"/> </zones>

XML

Copy Code

<!-- Define Security Zones-->
<zones default="NoRisk">
 <add name="NoRisk" description="Used for fields without any SXML"/>
 <add name="LowRisk" description="High security, low risk zone, used for most body fields"/>
 <add name="MediumRisk" inherits="LowRisk" description="Medium risk zone, used for application page body and normal translations"/>
 <add name="HighRisk" inherits="MediumRisk" description="Low security, high risk zone, used for rendertemplate body and system translations"/>
</zones>

Zones may or may not inherit from zones previously declared. In the example section, the MediumRisk Zone inherits from the LowRisk Zone and the HighRisk Zone inherits from the MediumRisk Zone. This means that any instruction mapped to the LowRisk Zone will automatically be available in the Medium- and HighRisk zones.

The SecurityZone CTFP can be used on Cms ContentTypeFields, to specify what type of instructions are allowed.

If the SecurityZone CTFP is not defined on a ContentTypeField, the zone specified as default is used. To be secure by design, If no default is given, the required LowRisk zone is used on fields without the SecurityZone CTFP.

SCAS Mappings

After declaring the zones, instructions can be mapped to them.

Mappings are interpreted from generic to specific, which means that the most specific declaration wins.

XML	Copy Code
<mappings> <!-- Map all SXML assets to one or more SCAS zones. Matches are made in the specified order, so add most specific rules first... --> <!-- Map all normal translations to the LowRisk zone... --> <add matchtype="translation" zones="LowRisk"/> <!-- Map all system translations to the LowRisk zone... --> <add matchtype="systemtranslation" zones="HighRisk"/> <!-- Vipers and macros can have the SXMLSecurityRiskLevel attribute set (see documentation). This allows to quickly map them to security zones based on implied risk, using matchtype="scaslevel". --> <add matchtype="scaslevel" expression="0" zones="LowRisk"/> <add matchtype="scaslevel" expression="1" zones="MediumRisk"/> <add matchtype="scaslevel" expression="2" zones="HighRisk"/> <!-- If not already mapped by previous rules, map remaining vipers to MediumRisk --> <add matchtype="viper" zones="MediumRisk"/> <!-- If not already mapped by previous rules, map remaining macros to HighRisk --> <add matchtype="macro" zones="HighRisk"/> <!-- Catch-all: map remaining assets to HighRisk zone... --> <add matchtype="any" zones="HighRisk"/> </mappings>

XML

Copy Code

<mappings>
 <!--
  Map all SXML assets to one or more SCAS zones.
  Matches are made in the specified order, so add most specific rules first...
 -->
 <!-- Map all normal translations to the LowRisk zone... -->
 <add matchtype="translation" zones="LowRisk"/>
 
 <!-- Map all system translations to the LowRisk zone... -->
 <add matchtype="systemtranslation" zones="HighRisk"/>
 
 <!--
 Vipers and macros can have the SXMLSecurityRiskLevel attribute set (see documentation).
 This allows to quickly map them to security zones based on implied risk, using matchtype="scaslevel".
 -->
 
 <add matchtype="scaslevel" expression="0" zones="LowRisk"/>
 <add matchtype="scaslevel" expression="1" zones="MediumRisk"/>
 <add matchtype="scaslevel" expression="2" zones="HighRisk"/>
 
 <!--
  If not already mapped by previous rules, map remaining vipers to MediumRisk
 -->
 <add matchtype="viper" zones="MediumRisk"/>
 
 <!--
  If not already mapped by previous rules, map remaining macros to HighRisk
  -->
 <add matchtype="macro" zones="HighRisk"/>
 
 <!--
  Catch-all: map remaining assets to HighRisk zone...
 -->
 <add matchtype="any" zones="HighRisk"/>
</mappings>

Advanced