CRV2 RevCodePersistentAntiPatterndotNet - Revision history

EoinKeary at 13:12, 1 August 2013

2013-08-01T13:12:31Z

EoinKeary: /* Binding issues in MVC .NET */

2013-08-01T12:58:23Z

‎Binding issues in MVC .NET

EoinKeary at 12:44, 1 August 2013

2013-08-01T12:44:19Z

Johanna Curiel at 01:34, 20 June 2013

2013-06-20T01:34:06Z

Johanna Curiel at 01:32, 20 June 2013

2013-06-20T01:32:57Z

Johanna Curiel at 02:37, 19 June 2013

2013-06-19T02:37:21Z

Johanna Curiel at 02:21, 19 June 2013

2013-06-19T02:21:52Z

Johanna Curiel at 02:20, 19 June 2013

2013-06-19T02:20:40Z

Johanna Curiel at 08:55, 18 June 2013

2013-06-18T08:55:51Z

Johanna Curiel at 08:44, 18 June 2013

2013-06-18T08:44:11Z

← Older revision		Revision as of 13:12, 1 August 2013
Line 1:		Line 1:
−	~~= Binding issues in MVC .NET=~~
−	~~'''A.K.A Over-Posting A.K.A Mass assignments'''~~
−
−	In MVC framework, mass assignments is a mechanism that allow us to update our models with data coming in a request in HTTP form fields. As the data that needs to be updated comes in a collection of form fields, a user could send a request and modify other fields in the model that may not be in the form and the developer didn’t intend to be updated.
−
−	Depending on the models you create, there might be sensitive data that you would not like to be modified. The vulnerability is exploited when a malicious user modifys a model’s fields which are not exposed to the user via the view and additional model parameters are added by the malicious user to change hidden model values.
−
−	~~public class user~~
−	{
−	~~public int ID { get; set; } <- exposed via view~~
−	~~public string Name { get; set; } <- exposed via view~~
−	~~public bool isAdmin{ get; set; } <-hidden from view~~
−	}
−
−	~~Corresponding view (HTML)~~
−
−	~~ID: <%= Html.TextBox("ID") %> <br>~~
−	~~Name: <%= Html.TextBox("Name") %> <br>~~
−	~~<-- no isAdmin here!~~
−
−
−	~~The correspondig HTML for this model contain 2 fields: '''ID''' and '''Name'''.~~
−	~~If an attacker adds the '''isAdmin''' parameter to the form and submitts they can change the model object above.~~
−	~~So a malicious attacker may change '''isAdmin=true'''~~
−
−	~~'''Recommendations:'''~~
−
−	~~1. Use a model which does not have values the user should not edit.~~
−	~~2. Use the bind method and whitelist attributes which can be updated.~~
−	~~3. Use the controller.UpdateModel method to exclude certain attribute updates.~~

	=.NET Anti-Pattern: Mishandled Concurrency =		=.NET Anti-Pattern: Mishandled Concurrency =

@@ Line 13: / Line 13: @@
+     }
-The correcpondig HTML for this model contain 2 fields: '''ID''' and '''Name'''.
+Corresponding view (HTML)
 If an attacker adds the '''isAdmin''' parameter to the form and submitts they can change the model object above.
 So a malicious attacker may change '''isAdmin=true'''

← Older revision		Revision as of 12:44, 1 August 2013
Line 1:		Line 1:
		+	= Binding issues in MVC .NET=
		+	'''A.K.A Over-Posting A.K.A Mass assignments'''
		+
		+	In MVC framework, mass assignments is a mechanism that allow us to update our models with data coming in a request in HTTP form fields. As the data that needs to be updated comes in a collection of form fields, a user could send a request and modify other fields in the model that may not be in the form and the developer didn’t intend to be updated.
		+
		+	Depending on the models you create, there might be sensitive data that you would not like to be modified. The vulnerability is exploited when a malicious user modifys a model’s fields which are not exposed to the user via the view and additional model parameters are added by the malicious user to change hidden model values.
		+
		+	public class user
		+	{
		+	public int ID { get; set; } <- exposed via view
		+	public string Name { get; set; } <- exposed via view
		+	public bool isAdmin{ get; set; } <-hidden from view
		+	}
		+
		+	The correcpondig HTML for this model contain 2 fields: '''ID''' and '''Name'''.
		+	If an attacker adds the '''isAdmin''' parameter to the form and submitts they can change the model object above.
		+	So a malicious attacker may change '''isAdmin=true'''
		+
		+	'''Recommendations:'''
		+
		+	1. Use a model which does not have values the user should not edit.
		+	2. Use the bind method and whitelist attributes which can be updated.
		+	3. Use the controller.UpdateModel method to exclude certain attribute updates.
		+
	=.NET Anti-Pattern: Mishandled Concurrency =		=.NET Anti-Pattern: Mishandled Concurrency =

@@ Line 18: / Line 18: @@
 Another anti-pattern approach used by many developers is to lock regions in the database.Most of the time , this is implemented as way to avoid concurrency, however web applications are not properly suited for using locking which will indeed freeze the application.
-Locking data for the time the request takes will not solve this problem. Using locks in database are absolutely not recommend since they required careful implementation planning and design.(Freeman, pg 179 ,2011)
+Locking data for the time the request takes place will not solve this problem. Using locks in database are absolutely not recommend since they required careful implementation planning and design.(Freeman, pg 179 ,2011)
 == Race conditions ==

@@ Line 17: / Line 17: @@
 == Avoid Locks ==
-Another anti-pattern approach used by many developers is to lock regions in the database.Web applications are not properly suited for using locking which will indeed freeze the application.
+Another anti-pattern approach used by many developers is to lock regions in the database.Most of the time , this is implemented as way to avoid concurrency, however web applications are not properly suited for using locking which will indeed freeze the application.
 Locking data for the time the request takes will not solve this problem. Using locks in database are absolutely not recommend since they required careful implementation planning and design.(Freeman, pg 179 ,2011)

@@ Line 1: / Line 1: @@
 =.NET Anti-Pattern: Mishandled Concurrency =
@@ Line 11: / Line 9: @@
 Main purpose of the ORM (Object Relational Mapper) is to create an abstraction, a representation of the database easier to manipulate and access data contained in it than retrieving it using SQL statements. Unfortunately, many developers assume that because the ORM is the middle layer handling the communication and manipulation of records, the data persistence will be handled without issues.
 The developer should analyze and observe what occurs at the database level once the ORM in question (such as EntityFramework, NHibernate or Ideablade for example) has been implemented. Concurrency issues can arise from incorrect fetching strategy implementations such as for example using ‘CachedOnly’ or ‘DataSourceThenCached’(IdeaBlade). It is highly recommended that the developer revises the proper application depending on the implementation scenario, such as multiple users accessing the same data at the same time in order to avoid data corruption or  when data is cached in an action by a certain Entity but the another one is not aware of this change.
 == Avoid Locks ==
@@ Line 54: / Line 57: @@
 * Keep in mind that Detached objects (such as in the case of NHibernate or IdeaBlade ORM's)may no longer be guaranteed to be synchronized with database state; they’re no longer under the management of NHibernate.However they could still contain persistent data. These ORM's allow you to reuse these instance by associating them with a new Persistence manager.
 == References ==

← Older revision		Revision as of 08:55, 18 June 2013
Line 3:		Line 3:


−	~~= Chatty Anti-pattern =~~	+

← Older revision		Revision as of 08:44, 18 June 2013
Line 1:		Line 1:
		+	= DTO Anti-pattern =
		+
		+
		+
		+	= Chatty Anti-pattern =
		+
		+
		+
	=.NET Anti-Pattern: Mishandled Concurrency =		=.NET Anti-Pattern: Mishandled Concurrency =