{"action":"created","issue":{"url":"https://api.github.com/repos/Antaris/RazorEngine/issues/217","labels_url":"https://api.github.com/repos/Antaris/RazorEngine/issues/217/labels{/name}","comments_url":"https://api.github.com/repos/Antaris/RazorEngine/issues/217/comments","events_url":"https://api.github.com/repos/Antaris/RazorEngine/issues/217/events","html_url":"https://github.com/Antaris/RazorEngine/issues/217","id":55096046,"number":217,"title":"Access denied exception with RazorEngine 3.5","user":{"login":"Krashlog","id":1075078,"avatar_url":"https://avatars.githubusercontent.com/u/1075078?v=3","gravatar_id":"","url":"https://api.github.com/users/Krashlog","html_url":"https://github.com/Krashlog","followers_url":"https://api.github.com/users/Krashlog/followers","following_url":"https://api.github.com/users/Krashlog/following{/other_user}","gists_url":"https://api.github.com/users/Krashlog/gists{/gist_id}","starred_url":"https://api.github.com/users/Krashlog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Krashlog/subscriptions","organizations_url":"https://api.github.com/users/Krashlog/orgs","repos_url":"https://api.github.com/users/Krashlog/repos","events_url":"https://api.github.com/users/Krashlog/events{/privacy}","received_events_url":"https://api.github.com/users/Krashlog/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Antaris/RazorEngine/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/Antaris/RazorEngine/labels/Compilation","name":"Compilation","color":"c7def8"},{"url":"https://api.github.com/repos/Antaris/RazorEngine/labels/Isolation","name":"Isolation","color":"fad8c7"},{"url":"https://api.github.com/repos/Antaris/RazorEngine/labels/need-info","name":"need-info","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-22T00:01:48Z","updated_at":"2015-01-22T18:48:22Z","closed_at":null,"body":"Hi,\r\n\r\nWe're using RazorEngine to generate emails in an ASP.Net Web Application. Since updating our code to version 3.5, the template compiling fails with the following stack trace:\r\n\r\n>Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))\r\n\r\nThe easiest way to test this is simply to create a blank website in Visual Studio, add the RazorEngine package, and plug the basic \"Hello World\" sample template. With 3.4.x, the code will run just fine. I've tracked the error to the CompileType method, when the process tries to load the generated assembly in the Windows Temp folder.\r\n\r\n> C:\\Windows\\Temp\\RazorEngine_grceyklj.1f1\\CompiledRazorTemplates.Dynamic.RazorEngine_6aa243ea4a104b1f8d7036145a4c87a0.dll\r\n>Event Class:\tFile System\r\n>Result:\tACCESS DENIED\r\n>Impersonating:\tDMZ\\iusr_web\r\n\r\nNote that our websites are using ASP.NET Impersonation, and the impersonated user is \"iuser_web\" ,from our DMZ domain. Giving this user read access to the C:\\Windows\\Temp\\ folder on the local machines fix the problem, and the templates are generated correctly. However, I'm not sure if this is the right course of action, since this used to work perfectly in 3.4.x.\r\n\r\nIs this a new requirement for 3.5 ?\r\n\r\nThanks,\r\nShaun"},"comment":{"url":"https://api.github.com/repos/Antaris/RazorEngine/issues/comments/71075184","html_url":"https://github.com/Antaris/RazorEngine/issues/217#issuecomment-71075184","issue_url":"https://api.github.com/repos/Antaris/RazorEngine/issues/217","id":71075184,"user":{"login":"Krashlog","id":1075078,"avatar_url":"https://avatars.githubusercontent.com/u/1075078?v=3","gravatar_id":"","url":"https://api.github.com/users/Krashlog","html_url":"https://github.com/Krashlog","followers_url":"https://api.github.com/users/Krashlog/followers","following_url":"https://api.github.com/users/Krashlog/following{/other_user}","gists_url":"https://api.github.com/users/Krashlog/gists{/gist_id}","starred_url":"https://api.github.com/users/Krashlog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Krashlog/subscriptions","organizations_url":"https://api.github.com/users/Krashlog/orgs","repos_url":"https://api.github.com/users/Krashlog/repos","events_url":"https://api.github.com/users/Krashlog/events{/privacy}","received_events_url":"https://api.github.com/users/Krashlog/received_events","type":"User","site_admin":false},"created_at":"2015-01-22T18:48:22Z","updated_at":"2015-01-22T18:48:22Z","body":"Thanks for the reply.\r\n\r\n> Unfortunately it seems to fail in your scenario, but I'm not sure why that is the case. Especially I cannot see why you can write in that directory but not read?\r\n\r\nI dug a little deeper and found something interesting : the call to CompileAssemblyFromSource doesn't carry forward the impersonated user, CSC.exe is thus executed under the AppPool identity. The DLL is written using that identity, but the impersonated user doesn't have read access to the resulting DLL.\r\n\r\nI have tried running the website with Full trust, and also tried adding RazorEngine to the GAC. The results are the same, the impersonated user gets ignored when CompileAssemblyFromSource is called. I'm not sure about the implications of using the Isolation API, do you think this could possibly fix my problem?\r\n\r\nI understand the design decision behind these changes, and in the meantime I'm running tests with read rights explicitly given to the Temp folder. Let me know how I can be of further help.\r\n\r\n"}}