Classic ASP Design Mistakes - Revision history

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T16:46:20Z

Added navigation to facilitate sequential reading online

KirstenS: /* ASP Pages Execution Order Issues */

2009-01-28T15:54:05Z

‎ASP Pages Execution Order Issues

KirstenS: /* IsClientConnected property */

2009-01-13T19:43:52Z

‎IsClientConnected property

KirstenS: /* Not using Option Explicit */

2009-01-13T19:43:27Z

‎Not using Option Explicit

KirstenS: /* Java classes hosted in MS Java Virtual Machine */

2009-01-13T19:42:47Z

‎Java classes hosted in MS Java Virtual Machine

KirstenS: /* ASP Pages Execution Order Issues */

2009-01-13T19:42:11Z

‎ASP Pages Execution Order Issues

KirstenS: /* Overview */

2009-01-13T19:37:07Z

‎Overview

KirstenS at 15:46, 3 September 2008

2008-09-03T15:46:06Z

KirstenS at 15:45, 3 September 2008

2008-09-03T15:45:37Z

KirstenS: /* ASP Pages Execution Order Issues */

2008-09-03T15:44:34Z

‎ASP Pages Execution Order Issues

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 ===Overview===
 There are several issues inherent to classic ASP pages that may lead to security issues. We are talking about beginner mistakes or code misuse. The following examples will give you a good idea of what is being discussed. All of these examples are based on common findings through experience of ASP testing.
@@ Line 124: / Line 130: @@
 ====IsClientConnected property====
 This property determines if the client has disconnected from the server since the last '''Response.Write'''. This property is particularly useful to prevent the server from continuing execution of long pages after an unexpected disconnect. As you might figured out, this is very useful property to avoid DoS attacks to the Server and DB in long execution pages.
 [[Category:OWASP Code Review Project]]

@@ Line 4: / Line 4: @@
 ===ASP Pages Execution Order Issues===
-First of all let's explain the processing levels on ASP pages. ASP pages are executed in the following way:
+ASP pages are executed in the following way:
 # '''Server Side Includes'''. First, the interpreter adds to the current file the text of all the files in include sentences and process it as if it was a single file.
@@ Line 10: / Line 10: @@
 # '''Client Side JAvascript/VBScript Code'''. Finally, once the page is completely loaded in the browser, JavaScript code is executed.
-This might be obvious, however ignoring this order might lead to severe security issues. Here are some examples.
+This might be obvious, however, ignoring this order might lead to severe security issues. Here are some examples.
 ===Wrong dynamic inclusion of files. ===

@@ Line 123: / Line 123: @@
 ====IsClientConnected property====
-This property determines if the client has disconnected from the server since the last '''Response.Write'''. This property is particularly useful to prevent the server from continuing execution of long pages after an unexpected disconnect. As you might figured out this is very useful property to avoid DoS attacks to the Server and DB in long execution pages.
+This property determines if the client has disconnected from the server since the last '''Response.Write'''. This property is particularly useful to prevent the server from continuing execution of long pages after an unexpected disconnect. As you might figured out, this is very useful property to avoid DoS attacks to the Server and DB in long execution pages.
 [[Category:OWASP Code Review Project]]

@@ Line 119: / Line 119: @@
 </pre>
-====Not using Option Explicit====
+====Not Using Option Explicit====
-Mistyped variables might lead to race conditions on business logic. This option will force the user to declare all the used variables, it will add a bit of performance as well.
+Mistyped variables might lead to race conditions on business logic. This option will force the user to declare all the used variables, and it will add a bit of performance as well.
 ====IsClientConnected property====

@@ Line 108: / Line 108: @@
 ==Other Issues==
 ====Java classes hosted in MS Java Virtual Machine====
-These classes can be called from ASP pages so you should look also for insecure functionality within such classes. This is an example:
+These classes can be called from ASP pages, so you should look also for insecure functionality within such classes. This is an example:
 <pre>

@@ Line 4: / Line 4: @@
 ===ASP Pages Execution Order Issues===
 First of all let's explain the processing levels on ASP pages. ASP pages are executed in the following way:
-# '''Server Side Includes'''. First, the interpreter adds to the current file the text of all the files in include sentences and process it as if ti was a single file.
+# '''Server Side Includes'''. First, the interpreter adds to the current file the text of all the files in include sentences and process it as if it was a single file.
 # '''Server Side VBSCript Code'''. Second, the VBScript in <% and %> code is executed.
-# '''Client Side JAvascript/VBScript Code'''. Finally once the page is completely loaded in the browser, JavaScript code is executed.
+# '''Client Side JAvascript/VBScript Code'''. Finally, once the page is completely loaded in the browser, JavaScript code is executed.
-This might be obvious, however ignoring this order might lead to severe security issues. Here are some examples
+This might be obvious, however ignoring this order might lead to severe security issues. Here are some examples.
-====Wrong dynamic inclusion of files. ====
+===Wrong dynamic inclusion of files. ===
 <pre>
   <%
@@ Line 26: / Line 26: @@
   %>
 </pre>
-The previous code will add the content of both files to the ASP page execution as SSI are executed first than ASP code, it is possible that the page is displayed correctly due to the "If" sentence, however all the code will be processed, this might lead to race condition or undesired execution of functions.
-====HTML and JavaScript comments do not skip execution of ASP code====
+===HTML and JavaScript comments do not skip execution of ASP code===
 <pre>
   <!-- <%= "Debug: This is the DB user: " & DBUserName %> -->
@@ Line 38: / Line 39: @@
 </pre>
-If you are proficient in ASP technology the result of the example above would be clear, however, many developers cannot tell the final output
+If you are proficient in ASP technology, the result of the example above would be clear, however, many developers cannot tell the final output.
 <pre>
@@ Line 49: / Line 50: @@
 </pre>
-Above shows that sensitive information the commented out code, is disclosed in HTML or JavaScript comments
+Above shows that sensitive information in the commented-out code is disclosed in HTML or JavaScript comments.
-====Using JavaScript to drive ASP functionality====
+===Using JavaScript to drive ASP functionality===
 Yes, this is not possible, but that is another reason to look for it.
 <pre>
@@ Line 69: / Line 70: @@
 </pre>
-The code above shall grant Admin privileges every time to the logged user as, as we saw before, ASP code is executed first.  Besides, there is no sharing of variables between JavaScript and ASP code.
+The code above shall grant Admin privileges every time to the logged user as, as we saw before, ASP code is executed first. Besides, there is no sharing of variables between JavaScript and ASP code.
 Another example:
@@ Line 84: / Line 85: @@
 </pre>
-You will always go to Yahoo and will never be displayed with a prompt, code within <% %> is executed first.
+You will always go to Yahoo and will never be displayed with a prompt; code within <% %> is executed first.
 <pre>
   <%
@@ Line 102: / Line 104: @@
 </pre>
-In example above, the "UpdateInformationFunction" is called all the time regardless of the "ValidInfo" variable value as ASP code is executed first than JavaScript, so ASP code is executed in server and the output is sent to Browser, then JavaScript is executed. That means that is required a '''Response.End''' to stop execution server side.
+In example above, the "UpdateInformationFunction" is called all the time regardless of the "ValidInfo" variable value, as ASP code is executed first, then JavaScript. ASP code is executed in server and the output is sent to Browser, then JavaScript is executed. That means that is required a  '''Response.End''' to stop execution server side.
 ==Other Issues==

← Older revision		Revision as of 15:46, 3 September 2008
Line 122:		Line 122:
	====IsClientConnected property====		====IsClientConnected property====
	This property determines if the client has disconnected from the server since the last '''Response.Write'''. This property is particularly useful to prevent the server from continuing execution of long pages after an unexpected disconnect. As you might figured out this is very useful property to avoid DoS attacks to the Server and DB in long execution pages.		This property determines if the client has disconnected from the server since the last '''Response.Write'''. This property is particularly useful to prevent the server from continuing execution of long pages after an unexpected disconnect. As you might figured out this is very useful property to avoid DoS attacks to the Server and DB in long execution pages.
		+
		+	[[Category:OWASP Code Review Project]]

← Older revision		Revision as of 15:45, 3 September 2008
Line 1:		Line 1:
		+	[[OWASP Code Review Guide Table of Contents]]__TOC__
	===Overview===		===Overview===
	There are several issues inherent to classic ASP pages that may lead to security issues, we are talking about beginner mistakes or coed misuse. The following examples will give you a good idea of what is being discussed. All of these examples are based on common findings through experience of ASP testing.		There are several issues inherent to classic ASP pages that may lead to security issues, we are talking about beginner mistakes or coed misuse. The following examples will give you a good idea of what is being discussed. All of these examples are based on common findings through experience of ASP testing.