Executing Untrusted Code

[Ben]

Hello,

I've been developing apps in Delphi for years and have just started
writing my first big project in c# + ms .net and have some questions
about security and untrusted code.

I've got an app that will run on a server on the net that will have
plugin capability, where a user could build an assembly that contains
a type derived from my base plugin type. I plan to load the plugin
assembly at runtime, instanciate the derived type and call it's
methods. Because of the nature of the project I cannot trust plugins
developers (can be anyone) not to write malicious code in their
plugin.

My main concerns with malicious plugin code are that:
1. The plugin may try to do naughty things like deleting files or
sending emails, etc.

2. The plugin may be able to access parts of the main application
which it shouldn't be allowed to see.

3. The plugin may get stuck in an infinate loop, effectively hanging
the entire app. I'd really like to stop executing the method of the
plugin if it takes longer than a set number of milliseconds.

4. The plugin may consume lots and lots of memory using collections,
etc.

Though I know little of it as yet, I figure I can use code access
security to limit the priviledges of the plugin which would hopefully
take care of concern #1 (right?). But as for the other concerns I'm
really not sure? I'm guessing for #3 I'd have to run the plugin in a
seperate thread and kill the thread if it takes too long?

I've studied what I can of the terrarium project which is very
similiar technically and somehow overcomes similiar issues but
unfortunately it seems microsoft never released the source code. :(

The project depends on the ability of .net to run untrusted code
safely which I thought it could. I just have to learn how. Can anybody
suggest what I can do to overcome any of these issues or atleast point
me in the right direction?