CRV2 InputValIntro - Revision history

Larry Conklin at 17:29, 5 April 2014

2014-04-05T17:29:29Z

Larry Conklin at 17:10, 5 April 2014

2014-04-05T17:10:42Z

Larry Conklin at 17:07, 5 April 2014

2014-04-05T17:07:18Z

Larry Conklin at 17:06, 5 April 2014

2014-04-05T17:06:34Z

Larry Conklin at 17:05, 5 April 2014

2014-04-05T17:05:02Z

Larry Conklin at 17:01, 5 April 2014

2014-04-05T17:01:23Z

Larry Conklin at 16:36, 5 April 2014

2014-04-05T16:36:01Z

Michael Hidalgo: Created page with " == Review code for input validation =="

2014-03-18T14:03:39Z

Created page with " == Review code for input validation =="

New page

== Review code for input validation ==

← Older revision		Revision as of 17:29, 5 April 2014
Line 63:		Line 63:

	var encodedInput = Server.HtmlEncode(userInput);		var encodedInput = Server.HtmlEncode(userInput);
		+
		+
		+	===Managed Code and NonManaged code===
		+	Both Java and .Net have the concept of managed and non-managed code. To offer some of these protections during the invocation of native code, do not declare a native method public. Instead, declare it private and expose the functionality through a public wrapper method. A wrapper can safely perform any necessary input validation prior to the invocation of the native method:
		+
		+	===Java Sample code to call a Native Method with Data Validation in place===
		+	public final class NativeMethodWrapper {
		+	private native void nativeOperation(byte[] data, int offset,
		+	int len);
		+
		+
		+	public void doOperation(byte[] data, int offset, int len) {
		+	// copy mutable input
		+	data = data.clone();
		+
		+	// validate input
		+	// Note offset+len would be subject to integer overflow.
		+	// For instance if offset = 1 and len = Integer.MAX_VALUE,
		+	// then offset+len == Integer.MIN_VALUE which is lower
		+	// than data.length.
		+	// Further,
		+	// loops of the form
		+	// for (int i=offset; i<offset+len; ++i) { ... }
		+	// would not throw an exception or cause native code to
		+	// crash.
		+
		+	if (offset < 0 \|\| len < 0 \|\| offset > data.length - len) {
		+	throw new IllegalArgumentException();
		+	}
		+
		+	nativeOperation(data, offset, len);
		+	}
		+	}
		+
		+

	===Data validations checklist for the Code Reviewer.===		===Data validations checklist for the Code Reviewer.===

← Older revision		Revision as of 17:10, 5 April 2014
Line 76:		Line 76:

	*"Golden Rule: All external input, no matter what it is, is examined and validated."		*"Golden Rule: All external input, no matter what it is, is examined and validated."
		+
		+
		+	Resources:
		+	http://msdn.microsoft.com/en-us/library/vstudio/system.uri

@@ Line 62: / Line 62: @@
 The next example shows how to HTML encode a value in code-behind.
-var encodedInput = Server.HtmlEncode(userInput);
+ var encodedInput = Server.HtmlEncode(userInput);
 ===Data validations checklist for the Code Reviewer.===

@@ Line 66: / Line 66: @@
 ===Data validations checklist for the Code Reviewer.===
-'''Data/Input Validation: '''
+*Ensure that a Data Validation mechanism is present.
 *Ensure all input that can (and will) be modified by a malicious user such as HTTP headers, input fields, hidden fields, drop down lists, and other web components are properly validated.
 *Ensure that the proper length checks on all input exist.
@@ Line 75: / Line 74: @@
 *Examine where data validation occurs and if a centralized model or decentralized model is used.
 *Ensure there are no backdoors in the data validation model.
 *"Golden Rule: All external input, no matter what it is, is examined and validated."

@@ Line 7: / Line 7: @@
 All data from users needs to be considered untrusted. Remember one of the top rules of secure coding is “Don’t trust user input”. Always validate user data with the full knowledge of what your application is trying to accomplish.
-Regular expressions can be used to validate user input, but the more complicated the regular express are the more chance it is not full proof and is very hard to test.
+Regular expressions can be used to validate user input, but the more complicated the regular express are the more chance it is not full proof and has errors for corner cases.  Regular expressions are also very hard fro QA  to test. Regular expressions may also make it hard for the code reviewer to do a good review of the regular expressions.
 ===Data Validation===

@@ Line 2: / Line 2: @@
 == Review code for input validation ==
-Validation of user input and encode output from users.
+===Introduction===
 All data from users needs to be considered untrusted. Remember one of the top rules of secure coding is “Don’t trust user input”. Always validate user data with the full knowledge of what your application is trying to accomplish.
 Regular expressions can be used to validate user input, but the more complicated the regular express are the more chance it is not full proof and is very hard to test.
 ===.Net Request Validation===

← Older revision		Revision as of 16:36, 5 April 2014
Line 1:		Line 1:

	== Review code for input validation ==		== Review code for input validation ==
		+
		+	Validation of user input and encode output from users.
		+
		+	All data from users needs to be considered untrusted. Remember one of the top rules of secure coding is “Don’t trust user input”. Always validate user data with the full knowledge of what your application is trying to accomplish.
		+
		+	Regular expressions can be used to validate user input, but the more complicated the regular express are the more chance it is not full proof and is very hard to test.
		+
		+	===.Net Request Validation===
		+	One solution is to use .Net “Request Validation”. Using request validation is a good start on validating user data and is useful. The downside is too generic and not specific enough to meet all of our requirements to provide full trust of user data.
		+
		+	You can never use request validation for securing your application against cross-site scripting attacks.
		+
		+	The following example shows how to use a static method in the Uri class to determine whether the Uri provided by a user is valid.
		+
		+	var isValidUri = Uri.IsWellFormedUriString(passedUri, UriKind.Absolute);
		+
		+	However, to sufficiently verify the Uri, you should also check to make sure it specifies http or https. The following example uses instance methods to verify that the Uri is valid.
		+
		+	var uriToVerify = new Uri(passedUri);
		+	var isValidUri = uriToVerify.IsWellFormedOriginalString();
		+	var isValidScheme = uriToVerify.Scheme == "http" \|\| uriToVerify.Scheme == "https";
		+
		+	Before rendering user input as HTML or including user input in a SQL query, encode the values to ensure malicious code is not included.
		+
		+	You can HTML encode the value in markup with the <%: %> syntax, as shown below.
		+
		+	<span><%: userInput %></span>
		+
		+	Or, in Razor syntax, you can HTML encode with @, as shown below.
		+
		+	<span>@userInput</span>
		+
		+	The next example shows how to HTML encode a value in code-behind.
		+
		+	var encodedInput = Server.HtmlEncode(userInput);
		+
		+	===Data validations checklist for the Code Reviewer.===
		+
		+	'''Data/Input Validation: '''
		+	*Ensure that a DV mechanism is present.
		+	*Ensure all input that can (and will) be modified by a malicious user such as HTTP headers, input fields, hidden fields, drop down lists, and other web components are properly validated.
		+	*Ensure that the proper length checks on all input exist.
		+	*Ensure that all fields, cookies, http headers/bodies, and form fields are validated.
		+	*Ensure that the data is well formed and contains only known good chars if possible.
		+	*Ensure that the data validation occurs on the server side.
		+	*Examine where data validation occurs and if a centralized model or decentralized model is used.
		+	*Ensure there are no backdoors in the data validation model.
		+	*"Golden Rule: All external input, no matter what it is, is examined and validated."
		+
		+
		+	http://www.asp.net/aspnet/overview/web-development-best-practices/what-not-to-do-in-aspnet,-and-what-to-do-instead#validation
		+
		+	https://www.owasp.org/index.php/OCRG1.1:Application_Threat_Modeling