SharePoint Customization Analysis Framework (SPCAF)

Farm/Sandboxed Solutions

Do not update list of blocked extensions

Avoid setting 'AllowUnsafeUpdates' on SPWeb

Avoid setting 'AllowUnsafeUpdates' on SPSite

Do not call 'WindowsIdentity.Impersonate'

Do not set 'AllowEveryoneViewItems' for SPList to TRUE

Avoid usage of 'RunWithElevatedPrivileges'

Do not add PageParserPaths to web.config

Do not call 'HttpUtility.HtmlEncode'.

Do not nest calls to RunWithElevatedPrivileges

CAS Policy 'Maschine' with access='Administer' is not allowed

Policy Permission Impersonate not allowed

Do not define 'FileIOPermission' with 'Unrestricted=true'

Do not define 'RegistryPermission' with 'Unrestricted=true'

Do not define 'SecurityPermission' with 'Unrestricted=true'

Do not define 'EnvironmentPermission' with 'Unrestricted=true'

Do not define 'SmtpPermission' with 'Unrestricted=true'

Do not set 'AllowEveryoneViewItems' to TRUE in ListDefinition

Do not use inline code in ASPX pages

Add 'SharePoint:FormDigest' to ASPX page

Do not define 'SmtpPermission' with 'Unrestricted=true'

The CAS Policy for System.Net.Mail.SmtpPermission with setting 'Unrestricted=true' is not allowed.

CheckId	SPC020615
TypeName	DoNotDefineUnrestrictedSMTPPermission
Severity	CriticalWarning
Type	PermissionSet

Remove permission 'SmtpPermission' with setting 'Unrestricted=true' or remove permission completely.
Bad Practice

<Solution xmlns="http://schemas.microsoft.com/sharepoint/">
  <CodeAccessSecurity>
    <PolicyItem>
      <PermissionSet class="NamedPermissionSet" version="1">
      ...
        <IPermission class="System.Net.Mail.SmtpPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Unrestricted="True" />
      ...
      </PermissionSet>
    <PolicyItem>
  <CodeAccessSecurity>
</Solution>

Using Code Access Security with ASP.NET

Message Suppression

Copyright © 2009 - 2020 Rencore

SharePoint Customization Analysis Framework (SPCAF), 7.15.0.0

Disclaimer: The views and opinions expressed in this documentation and in SPCAF do not necessarily reflect the opinions and recommendations of Microsoft or any member of Microsoft. SPCAF and RENCORE are registered trademarks of Rencore. All other trademarks, service marks, collective marks, copyrights, registered names, and marks used or cited by this documentation are the property of their respective owners.