CRV2 FrameworkSpecIssuesdotNetMVC - Revision history

Bill Sempf at 23:35, 10 April 2014

2014-04-10T23:35:14Z

Johanna Curiel at 08:49, 2 August 2013

2013-08-02T08:49:01Z

Johanna Curiel at 08:37, 2 August 2013

2013-08-02T08:37:39Z

Johanna Curiel at 08:22, 2 August 2013

2013-08-02T08:22:02Z

Johanna Curiel at 08:19, 2 August 2013

2013-08-02T08:19:40Z

EoinKeary at 13:12, 1 August 2013

2013-08-01T13:12:11Z

Johanna Curiel at 18:37, 2 July 2013

2013-07-02T18:37:06Z

Johanna Curiel at 18:28, 2 July 2013

2013-07-02T18:28:36Z

Johanna Curiel at 17:14, 2 July 2013

2013-07-02T17:14:27Z

Johanna Curiel at 17:13, 2 July 2013

2013-07-02T17:13:41Z

← Older revision		Revision as of 23:35, 10 April 2014
Line 171:		Line 171:

	MSDN, 2013 Anti-Cross Site Scripting Library available at http://msdn.microsoft.com/en-us/security/aa973814.aspx (last viewed: 2nd July, 2013)		MSDN, 2013 Anti-Cross Site Scripting Library available at http://msdn.microsoft.com/en-us/security/aa973814.aspx (last viewed: 2nd July, 2013)
		+
		+	[[Category:OWASP .NET Project]]

@@ Line 28: / Line 28: @@
 '''Recommendations:'''
-. Use a model which does not have values the user should not edit.
+*-1 Use a model which does not have values the user should not edit.
-. Use the bind method and whitelist attributes which can be updated.
+*-2 Use the bind method and whitelist attributes which can be updated.
-. Use the controller.UpdateModel method to exclude certain attribute updates.
+*-3 Use the controller.UpdateModel method to exclude certain attribute updates.
 == Anti-XSS==

@@ Line 45: / Line 45: @@
 ===Razor Syntax MVC3 ===
 An option to for XSS protection is the use of Razor syntax for ASP.NET MVC3 applications
+use the following code for this purpose:
   @message
 ===MVC4 anti XSS feature ===
 in ASP.NET MVC4 It is possible to override the standard HTML encoder by using the XSS encoder
-For this, download the code, compile it and add the library as a reference to the application. In the web.config, add the following line in the <system.web> section:
+For this, download the code, compile it and add the library as a reference to the application.
   <httpRuntime encoderType=
     "Microsoft.Security.Application.AntiXssEncoder, AntiXssLibrary"/>
 == Protection against SQL injections ==

@@ Line 50: / Line 50: @@
 ===MVC4 anti XSS feature ===
 in ASP.NET MVC4 It is possible to override the standard HTML encoder by using the XSS encoder
-you must download the code, compile it and add the library as a reference to your application. In the web.config, add the following line in the <system.web> section:
+For this, download the code, compile it and add the library as a reference to the application. In the web.config, add the following line in the <system.web> section:
   <httpRuntime encoderType=

← Older revision		Revision as of 08:19, 2 August 2013
Line 42:		Line 42:

	The HTMLEncode method applies HTML encoding to a specified string. This is useful as a quick method of encoding form data and other client request data before using it in your Web application. Encoding data converts potentially unsafe characters to their HTML-encoded equivalent.(MSDN,2013)		The HTMLEncode method applies HTML encoding to a specified string. This is useful as a quick method of encoding form data and other client request data before using it in your Web application. Encoding data converts potentially unsafe characters to their HTML-encoded equivalent.(MSDN,2013)
		+
		+	===Razor Syntax MVC3 ===
		+	An option to for XSS protection is the use of Razor syntax for ASP.NET MVC3 applications
		+
		+	@message
		+
		+	===MVC4 anti XSS feature ===
		+	in ASP.NET MVC4 It is possible to override the standard HTML encoder by using the XSS encoder
		+	you must download the code, compile it and add the library as a reference to your application. In the web.config, add the following line in the <system.web> section:
		+
		+	<httpRuntime encoderType=
		+	"Microsoft.Security.Application.AntiXssEncoder, AntiXssLibrary"/>

	== Protection against SQL injections ==		== Protection against SQL injections ==

← Older revision		Revision as of 13:12, 1 August 2013
Line 1:		Line 1:
	= ASP.NET Security in MVC =		= ASP.NET Security in MVC =

		+	== Binding issues in MVC .NET==
		+	'''A.K.A Over-Posting A.K.A Mass assignments'''
		+
		+	In MVC framework, mass assignments is a mechanism that allow us to update our models with data coming in a request in HTTP form fields. As the data that needs to be updated comes in a collection of form fields, a user could send a request and modify other fields in the model that may not be in the form and the developer didn’t intend to be updated.
		+
		+	Depending on the models you create, there might be sensitive data that you would not like to be modified. The vulnerability is exploited when a malicious user modifys a model’s fields which are not exposed to the user via the view and additional model parameters are added by the malicious user to change hidden model values.
		+
		+	public class user
		+	{
		+	public int ID { get; set; } <- exposed via view
		+	public string Name { get; set; } <- exposed via view
		+	public bool isAdmin{ get; set; } <-hidden from view
		+	}
		+
		+	Corresponding view (HTML)
		+
		+	ID: <%= Html.TextBox("ID") %> <br>
		+	Name: <%= Html.TextBox("Name") %> <br>
		+	<-- no isAdmin here!
		+
		+
		+	The correspondig HTML for this model contain 2 fields: '''ID''' and '''Name'''.
		+	If an attacker adds the '''isAdmin''' parameter to the form and submitts they can change the model object above.
		+	So a malicious attacker may change '''isAdmin=true'''
		+
		+	'''Recommendations:'''
		+
		+	1. Use a model which does not have values the user should not edit.
		+	2. Use the bind method and whitelist attributes which can be updated.
		+	3. Use the controller.UpdateModel method to exclude certain attribute updates.
		+
		+	== Anti-XSS==
	Traditional ASP.NET applications do not suffer from XSS attacks, contrary to MVC ASP.NET applications. When MVC web apps are exposed to malicious XSS code, they will not throw an error likethe following one:		Traditional ASP.NET applications do not suffer from XSS attacks, contrary to MVC ASP.NET applications. When MVC web apps are exposed to malicious XSS code, they will not throw an error likethe following one:

@@ Line 68: / Line 68: @@
 *RegularExpressionValidator – Checks user input against a regular expression.
 ===Disadvantages===
@@ Line 77: / Line 73: @@
 Another disadvantage is that this does not avoid any attacks originated from other application or if stored in the database, neither will offer any protection when input is injected in HTML attributes.
 == MVC’s CSFR anti-forgery system ==

@@ Line 1: / Line 1: @@
 = ASP.NET Security in MVC =
-Traditional ASP.NET applications do not suffer from XSS attacks, contrary to MVC ASP.NET applications. When MVC web apps are exposed to malicious XSS code, they will not throw an error ;lik ethe following one:
+Traditional ASP.NET applications do not suffer from XSS attacks, contrary to MVC ASP.NET applications. When MVC web apps are exposed to malicious XSS code, they will not throw an error likethe following one:
 [[File:Error_asp_validation.jpg]]
@@ Line 66: / Line 66: @@
 *RangeValidator – Checks if the value of an input control is within a defined range of  values.
 *RegularExpressionValidator – Checks user input against a regular expression.
 ===Disadvantages===
@@ Line 104: / Line 109: @@
 MSDN, 2013 HtmlHelper.AntiForgeryToken Method available at http://msdn.microsoft.com/en-us/library/dd470175%28v=vs.108%29.aspx (last viewed: 2nd July, 2013)

← Older revision		Revision as of 17:13, 2 July 2013
Line 102:		Line 102:
	== References ==		== References ==
	MSDN, 2013 - Server.HTMLEncode Method available at http://msdn.microsoft.com/en-us/library/ms525347%28v=vs.90%29.aspx (last viewed: 2nd July, 2013)		MSDN, 2013 - Server.HTMLEncode Method available at http://msdn.microsoft.com/en-us/library/ms525347%28v=vs.90%29.aspx (last viewed: 2nd July, 2013)
		+
		+	MSDN, 2013 HtmlHelper.AntiForgeryToken Method available at http://msdn.microsoft.com/en-us/library/dd470175%28v=vs.108%29.aspx (last viewed: 2nd July, 2013)