CRV2 FrameworkSpecIssuesASPClassic - Revision history

Johanna Curiel at 02:54, 22 September 2013

2013-09-22T02:54:09Z

Johanna Curiel at 02:45, 22 September 2013

2013-09-22T02:45:09Z

Johanna Curiel at 02:43, 22 September 2013

2013-09-22T02:43:45Z

Johanna Curiel: Created page with "=CLASSIC ASP= Unlike Java and .NET, classic ASP pages do not have structured error handling in try-catch blocks. Instead they have a specific object called "err". This make e..."

2013-09-22T02:40:53Z

Created page with "=CLASSIC ASP= Unlike Java and .NET, classic ASP pages do not have structured error handling in try-catch blocks. Instead they have a specific object called "err". This make e..."

New page

=CLASSIC ASP=
Unlike Java and .NET, classic ASP pages do not have structured error handling in try-catch blocks. Instead they have a
specific object called "err". This make error handling in a classic ASP pages hard to do and prone to design errors on error
handlers, causing race conditions and information leakage. Also, as ASP uses VBScript (a subtract of Visual Basic), sentences
like "On Error GoTo label" are not available.

==Vulnerable Patterns for Error Handling==
===Page_Error ===
Page_Error is page level handling which is run on the server side. Below is an example but the error information is a little
too informative and hence bad practice.

<script language="C#" runat="server">
Sub Page_Error(Source As Object, E As EventArgs)
Dim message As String = "<font face=verdana color=red>
<h1>" & Request.Url.ToString()& "</h1>" & "<pre><font color='red'>"
& Server.GetLastError().ToString()& "</pre></font>"
Response.Write(message) // display message End Sub </script>

The text in the example above has a number of issues: Firstly, it redisplay the HTTP request to the user in the form of
Request.Url.ToString() Assuming there has been no data validation prior to this point, we are vulnerable to cross site
scripting attacks!! Secondly the error message and stack trace is displayed to the user using Server.GetLastError().ToString()
which divulges internal information regarding the application.

@@ Line 9: / Line 9: @@
 Page_Error is page level handling which is run on the server side. Below is an example but the error information is a little
 too informative and hence bad practice.
 The text in the example above has a number of issues: Firstly, it redisplay the HTTP request to the user in the form of Request.Url.ToString() Assuming there has been no data validation prior to this point, we are vulnerable to cross site  mscripting attacks!! Secondly the error message and stack trace is displayed to the user using Server.GetLastError().ToString() which divulges internal information regarding the application.

@@ Line 10: / Line 10: @@
 too informative and hence bad practice.
-  <script language="C#" runat="server">
+  <script language="C#" runat='server'>
- Sub Page_Error(Source As Object, E As EventArgs)
+  Sub Page_Error(Source As Object, E As EventArgs)
- Dim message As String = "<font face=verdana color=red>
+    Dim message As String = '<font face=verdana color=red><h1>' & Request.Url.ToString()& '</h1>' & '<pre><font color='red'>'
- <h1>" & Request.Url.ToString()& "</h1>" & "<pre><font color='red'>"
+  & Server.GetLastError().ToString()& '</pre></font>'
   Response.Write(message) // display message End Sub </script>
-The text in the example above has a number of issues: Firstly, it redisplay the HTTP request to the user in the form of
+The text in the example above has a number of issues: Firstly, it redisplay the HTTP request to the user in the form of Request.Url.ToString() Assuming there has been no data validation prior to this point, we are vulnerable to cross site  mscripting attacks!! Secondly the error message and stack trace is displayed to the user using Server.GetLastError().ToString() which divulges internal information regarding the application.