line application (a Java app) when the user submits a form. What is
the best method for approaching this?
I've read about using the Diagnostics.Process class. One user raised
a concern about the security hole this approach creates (because you
have to give the ASPNET user execute permissions). In a dedicated
hosting environment, what kind of risk would be raised by giving the
ASPNET user these permissions?Anybody accessing the web server would be able to execute the program
- but it's hard to judge the risk without knowing what the program
does, what it's input and outputs are, etc. I'd also be concerned
about the scalability of the solution - so I'd test with the number of
concurrent users you expect the site to see and make sure the process
doesn't drag the server down.
--
Scott
http://www.OdeToCode.com/blogs/scott/
On 21 Oct 2004 06:20:54 -0700, lybbert@.adelphia.net (Aimee) wrote:
>I have created an ASP.NET (VB) website and need to invoke a command
>line application (a Java app) when the user submits a form. What is
>the best method for approaching this?
>I've read about using the Diagnostics.Process class. One user raised
>a concern about the security hole this approach creates (because you
>have to give the ASPNET user execute permissions). In a dedicated
>hosting environment, what kind of risk would be raised by giving the
>ASPNET user these permissions?
if your aspx page creates the process and pipe the input/output, then you
will not need to set execute permission in iis. this is the safest way.
-- bruce (sqlwork.com)
"Aimee" <lybbert@.adelphia.net> wrote in message
news:b455008f.0410210520.2721389c@.posting.google.c om...
> I have created an ASP.NET (VB) website and need to invoke a command
> line application (a Java app) when the user submits a form. What is
> the best method for approaching this?
> I've read about using the Diagnostics.Process class. One user raised
> a concern about the security hole this approach creates (because you
> have to give the ASPNET user execute permissions). In a dedicated
> hosting environment, what kind of risk would be raised by giving the
> ASPNET user these permissions?
What I have done in the past is create w indows servie to do the invocation,
using asp to simply gather details for the invocation of the exe using
process.start.
If both read/write from the same DB then the asp.net app can track and
report progress of the invoked applications output without asp.net requiring
execute permissions.
--
Regards
John Timney
Microsoft Regional Director
Microsoft MVP
"Aimee" <lybbert@.adelphia.net> wrote in message
news:b455008f.0410210520.2721389c@.posting.google.c om...
> I have created an ASP.NET (VB) website and need to invoke a command
> line application (a Java app) when the user submits a form. What is
> the best method for approaching this?
> I've read about using the Diagnostics.Process class. One user raised
> a concern about the security hole this approach creates (because you
> have to give the ASPNET user execute permissions). In a dedicated
> hosting environment, what kind of risk would be raised by giving the
> ASPNET user these permissions?
0 comments:
Post a Comment