Using security-related attributes

One or more computer storage devices having stored thereon computer-executable instructions that, when executed by a processor of a computing system, perform a method for determining whether code is safe to be called by an untrusted program, the method comprising:

• accessing a set of code of the computing system;
• evaluating a plurality of code paths corresponding to one or more callers of the set of code, wherein evaluating the one or more callers of the set of code comprises:
• identifying all direct callers of the set of code;
• evaluating all direct callers of the set of code and determining whether the set of code leaks critical data to such direct callers;
• after identifying all direct callers of the set of code, recursively identifying all indirect callers of the set of code by using the set of code, wherein indirect callers are identified as being distinguished from direct callers and includes any callers that:
• (a) call direct callers;
• or (b) call other indirect callers;
• evaluating indirect callers of the set of code and determining whether the set of code leaks critical data to such indirect callers;
• and
• determining that at least one direct caller or indirect caller is marked with a TreatAsSafe or Demand attribute and, in response, abstaining from further recursive evaluation of indirect callers above such at least one direct caller or indirect caller;
• and
• evaluating at least one code path corresponding to one or more callees of the set of code, wherein evaluating the at least one code path corresponding to the one or more callees of the set of code includes determining whether the set of code leaks critical data to the one or more callees of the set of code.

A method for determining whether code is safe to be called by an untrusted program, the method comprising:

• at a computing system that includes a processor communicatively coupled to computer-readable media having thereon a set of code and an untrusted program that has been sandboxed to limit its ability to request actions with respect to the set of code:
• intentionally requesting an action be taken on the set of code that the sandboxed, untrusted program does not have permission to request;
• throwing a security exception upon determining that the untrusted program does not have permission to request the action;
• after throwing the security exception, reviewing the set of code to determine whether the set of code corresponds to an added elevation, wherein reviewing the set of code comprises:
• using a helper class and refactoring the set of code into smaller functions, including breaking dangerous operations into smaller, isolated functions;
• determining whether the smaller functions are able to contain criticality and avoid leaking critical data;
• and
• marking smaller functions that are able to contain criticality and avoid leaking critical data as safe;
• considering an application programming interface (API) as part of the sandbox and marking the API with a security critical tag;
• and
• evaluating the set of code to determine whether the set of code is safe by determining whether it leaks any of its criticality, wherein evaluating the set of code comprises:
• determining whether parameters and class field inputs are considered safe;
• determining whether returned values are non-critical;
• marking the set of code as safe only when inputs are considered safe and returned values are non-critical;
• when parameters or class field inputs are not considered safe, or when returned values are critical, evaluating callers of the set of code, which comprises:
• recursively determining all callers, wherein all callers include all direct callers and all callers of other callers, of the set of code;
• upon accessing a caller that is yet unexamined, adding a security critical tag to such caller;
• determining whether parameters and class field inputs are considered safe for each caller;
• determining whether returned values are non-critical for each caller;
• stopping evaluation of any code path once a demand or TreatAsSafe tag is encountered;
• and
• marking the set of code as safe only when inputs are considered safe and returned values are non-critical, or when a demand or TreatAsSafe tag is encountered.