CRV2 ClientSideCodeBrowserDefPol - Revision history

Larry Conklin at 20:08, 2 August 2014

2014-08-02T20:08:23Z

Larry Conklin at 20:02, 2 August 2014

2014-08-02T20:02:27Z

Larry Conklin at 19:57, 2 August 2014

2014-08-02T19:57:32Z

Larry Conklin at 19:49, 2 August 2014

2014-08-02T19:49:47Z

Larry Conklin at 03:05, 30 July 2014

2014-07-30T03:05:01Z

Larry Conklin: Created page with " Browser Defense Scheme: // Login.passworld@ addess :port /path/to/resource ?query_string #fragment 1. Scheme/protocol name 2. Indicator of a hierarchical URL (constant)_ 3..."

2014-07-30T03:02:57Z

Created page with " Browser Defense Scheme: // Login.passworld@ addess :port /path/to/resource ?query_string #fragment 1. Scheme/protocol name 2. Indicator of a hierarchical URL (constant)_ 3..."

New page

Browser Defense

Scheme: // Login.passworld@ addess :port /path/to/resource ?query_string #fragment

1. Scheme/protocol name
2. Indicator of a hierarchical URL (constant)_
3. Credentials to access the resource (optional)
4. Server to retrieve the data from
5. Port number to connect to (optional)
6. Hierarchical Unix path to a resource
7. “Query string” parameters (optional)
8. “Fragment identifier” (optional)

If application allows user-supplied data in the URL then the code reviewer needs to make sure the path, query or Fragment Id Code data is validated.

Make sure user-supplied scheme name or authority section has good input validation. This is a major code injection and phishing risk. Only permit prefixes needed by the application. Do not use blacklisting. Code reviewer should make sure only whitelisting is used for validation.

Make sure authority section should only contain alphanumerics, “-“, and “.” And be followed by “/”, “?”,”#”. The risk here an IDN homograph attack.

Code reviewer needs to make sure the programmer is not assuming default behavior because the programmers browser properly escapes a particular character or browser standard says the character will be escaped properly before allowing any URL-derived values are put inside a database query or the URL is echoed back to the user.

@@ Line 6: / Line 6: @@
 Internet Explorer has two major exceptions when it comes to same origin policy
 # Trust Zones: if both domains are in highly trusted zone e.g, corporate domains, then the same origin limitations are not applied
-# Port: IE doesn't include port into Same Origin components, therefore http://yourcompany.com:81/index.html  and http://yourcompany.com/index.html are considered from same origin and no restrictions are applied.
+# Port: IE doesn't include port into Same Origin components, therefore http://yourcompany.com:81/index.html  and http://yourcompany.com/index.html are considered from same origin and no restrictions are applied. Microsoft does that port number into account for XMLHttpRequest.
 These exceptions are non-standard and not supported in any of other browser but would be helpful if developing an app for Windows RT (or) IE based web application.

@@ Line 63: / Line 63: @@
 ==Trust==
 For example consider the HTML form element:
-form method="POST" action="https://example.com/login">
+ form method="POST" action="https://example.com/login">
      ... <input type="password"> ...
     </form>

@@ Line 1: / Line 1: @@
-Browser Defense
+=Browser Defense/Same Origin Policy=
-===Examples===
+These exceptions are non-standard and not supported in any of other browser but would be helpful if developing an app for Windows RT (or) IE based web application.
 The following figure displays two example URIs (<code>foo://username:password@example.com:8042/over/there/index.dtb?type=animal&name=narwhal#nose</code> and <code>urn:example:animal:ferret:nose</code>) and their component parts. (The examples are derived from RFC 3986 — STD 66, chapter 3).
 <pre>
@@ Line 33: / Line 41: @@
 </pre>
-−
 # Scheme/protocol name
@@ Line 43: / Line 51: @@
 # “Query string” parameters (optional)
 # “Fragment identifier” (optional)
 If application allows user-supplied data in the URL then the code reviewer needs to make sure the path, query or Fragment Id Code data is validated.
@@ Line 51: / Line 60: @@
 Code reviewer needs to make sure the programmer is not assuming default behavior because the programmers browser properly escapes a particular character or browser standard says the character will be escaped properly before allowing any URL-derived values are put inside a database query or the URL is echoed back to the user.

← Older revision		Revision as of 19:49, 2 August 2014
Line 3:		Line 3:


−	~~Scheme~~: // ~~Login~~.~~passworld~~@ ~~addess~~ :port /path/to/~~resource~~ ?~~query_string #fragment~~	+
		+	===Examples===
		+	The following figure displays two example URIs (<code>foo://username:password@example.com:8042/over/there/index.dtb?type=animal&name=narwhal#nose</code> and <code>urn:example:animal:ferret:nose</code>) and their component parts. (The examples are derived from RFC 3986 — STD 66, chapter 3).
		+	<pre>
		+	foo://username:password@example.com:8042/over/there/index.dtb?type=animal&name=narwhal#nose
		+	\_/ \_______________/ \_________/ \__/ \___/ \_/ \______________________/ \__/
		+	\| \| \| \| \| \| \| \|
		+	\| userinfo hostname port \| \| query fragment
		+	\| \________________________________/\_____________\|____\|/ \__/ \__/
		+	\| \| \| \| \| \| \|
		+	\| \| \| \| \| \| \|
		+	scheme authority path \| \| interpretable as keys
		+	name \_______________________________________________\|____\|/ \____/ \_____/
		+	\| \| \| \| \| \|
		+	\| hierarchical part \| \| interpretable as values
		+	\| \| \|
		+	\| path interpretable as filename \|
		+	\| ___________\|____________ \|
		+	/ \ / \ \|
		+	urn:example:animal:ferret:nose interpretable as extension
		+
		+	path
		+	_________\|________
		+	scheme / \
		+	name userinfo hostname query
		+	_\|__ ___\|__ ____\|____ _____\|_____
		+	/ \ / \ / \ / \
		+	<nowiki>mailto:username@example.com?subject=Topic</nowiki>
		+	</pre>
		+
		+	S

	# Scheme/protocol name		# Scheme/protocol name

@@ Line 5: / Line 5: @@
 Scheme:	//	Login.passworld@	addess	:port	/path/to/resource	?query_string	#fragment
-.	Scheme/protocol name
+# Scheme/protocol name
-.	Indicator of a hierarchical URL (constant)_
+# Indicator of a hierarchical URL (constant)_
-.	Credentials to access the resource (optional)
+# Credentials to access the resource (optional)
-.	Server to retrieve the data from
+# Server to retrieve the data from
-.	Port number to connect to (optional)
+# Port number to connect to (optional)
-.	Hierarchical Unix path to a resource
+# Hierarchical Unix path to a resource
-.	“Query string” parameters (optional)
+# “Query string” parameters (optional)
-.	“Fragment identifier” (optional)
+# “Fragment identifier” (optional)
 If application allows user-supplied data in the URL then the code reviewer needs to make sure the path, query or Fragment Id Code data is validated.