C# 3.5 winforms app upgraded to C#4.0 issue because of the exclusion of CAS

Question

I have a C# 4.0 Winform app that I just upgraded from 3.5 to 4.0. The C# 4.0 Winforms app references a C# 3.5 dll that will load a series of dlls from network paths based off of user selections and then create/invoke the dlls using System.Reflection. Everything worked just fine when the application was set to use 3.5 as the target framework. I was getting this error after upgrading :

An attempt was made to load an assembly from a network location which would have caused the assembly to be sandboxed in previous versions of the .NET Framework. This release of the .NET Framework does not enable CAS policy by default, so this load may be dangerous. If this load is not intended to sandbox the assembly, please enable the loadFromRemoteSources switch. See http://go.microsoft.com/fwlink/?LinkId=155569 for more information.

This happens when I am trying to load the assembly from the network path :

var assembly = Assembly.LoadFile(path);

In doing some research I discovered that CAS was "sort of" eliminated in the 4.0 release. I was advised to put the following entries in my app.config :

<runtime>
    <loadFromRemoteSources enabled="true"/>
    <NetFx40_LegacySecurityPolicy enabled="true"/>
</runtime>

Now, the exception I'm getting is :

Exception has been thrown by the target of an invocation. at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandleInternal& ctor, Boolean& bNeedSecurityCheck) at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean skipCheckThis, Boolean fillCache) at System.RuntimeType.CreateInstanceDefaultCtor(Boolean publicOnly, Boolean skipVisibilityChecks, Boolean skipCheckThis, Boolean fillCache) at System.Activator.CreateInstance(Type type, Boolean nonPublic) at System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) at System.Activator.CreateInstance(Type type, BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) at System.Reflection.Assembly.CreateInstance(String typeName, Boolean ignoreCase, BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) at System.Reflection.Assembly.CreateInstance(String typeName) at Architecture.Data.Transformations.AssemblyHelperBase.CreateInstanceExplicit[T](Assembly assembly, String typeName) at Architecture.Data.Transformations.MappingTransform.ProcessMap(String map, String path, IXPathNavigable doc) at Architecture.Data.Transformations.MappingTransform.Execute(String map, String path, XmlDocument transformedXml) at Architecture.Data.Transformations.MappingTransform.Execute(XmlDocument transformedXml, Int32 historyID) at Architecture.Data.Transformations.TransformationsDataService.TransformXmlMap(XmlDocument transformedXml, Int32 historyID) at Architecture.Data.Transformations.TransformationsDataService.CreatePCSXml(HistoryRecord historyRecord) at Architecture.Data.Transformations.TransformationsDataService.ReShred(Int32 historyID)

The inner exception is : That assembly does not allow partially trusted callers.

This exception is thrown AFTER I've loaded the assembly from the network location, but am trying to use the Activator to create an instance of a type in the assembly.

protected T CreateInstanceExplicit<T>(Assembly assembly, String typeName)
{
    return (T)assembly.CreateInstance(typeName);
}

The C#4.0 Winforms app is signed (.snk file). Click Once security settings are checked as a full trust application. I've tried combinations of changing the app.config settings and the project settings even removing the signing. I am at my wits-end here trying to figure out what I can do in order to have the winforms app stay 4.0 instead of 3.5. Can anyone help?

Answer 1

Your <loadFromRemoteSources> element has no effect. It is explicitly noted in the MSDN docs for it:

The enabled attribute for this element is effective only when code access security (CAS) is disabled.

You enabled CAS. Run Caspol.exe to assign trust to the network location. Instructions are here.