Data Validation - Revision history

Bill Sempf: Removed ASP.NET 2.0 reference

2013-12-02T04:13:50Z

Removed ASP.NET 2.0 reference

KirstenS: /* Data Validation and Interpreter Injection */

2009-05-01T12:13:21Z

‎Data Validation and Interpreter Injection

KirstenS: /* Selects, radio buttons, and checkboxes */

2009-05-01T12:11:00Z

‎Selects, radio buttons, and checkboxes

KirstenS: /* Data Validation and Interpreter Injection */

2009-03-04T01:41:04Z

‎Data Validation and Interpreter Injection

KirstenS: /* Data Validation and Interpreter Injection */

2009-03-04T01:38:36Z

‎Data Validation and Interpreter Injection

KirstenS: /* Per-User Data */

2009-03-04T01:35:35Z

‎Per-User Data

KirstenS: /* No validation */

2009-03-04T01:30:21Z

‎No validation

Pileofrogs: /* Sanitize */

2008-10-29T19:51:22Z

‎Sanitize

KirstenS: /* Description */

2008-09-18T12:57:29Z

‎Description

KirstenS: /* Data Validation and Interpreter Injection */

2008-09-03T15:16:51Z

‎Data Validation and Interpreter Injection

@@ Line 258: / Line 258: @@
 * Encrypt viewstate if any of the data is application sensitive
-* Upgrade to ASP.NET 2.0 as soon as practical if you are on a shared hosting arrangement
+* Upgrade to the latest version of ASP.NET as soon as practical
 * Move truly sensitive viewstate data to the session variable instead

← Older revision		Revision as of 12:13, 1 May 2009
Line 402:		Line 402:
	==Data Validation and Interpreter Injection ==		==Data Validation and Interpreter Injection ==

−	This section focuses on preventing injection in ColdFusion. Interpreter Injection involves manipulating application parameters to execute malicious code on the system. The most prevalent of these is SQL injection but it also includes other injection techniques, including LDAP, ORM, User Agent, XML, etc. – see ~~the~~ [[Reviewing_Code_for_OS_Injection\|Interpreter Injection]] ~~chapter of this document~~ for greater details. As a developer you should assume that all input is malicious. Before processing any input coming from a user, data source, component, or data service it should be validated for type, length, and/or range. ColdFusion includes support for Regular Expressions and CFML tags that can be used to validate input.	+	This section focuses on preventing injection in ColdFusion. Interpreter Injection involves manipulating application parameters to execute malicious code on the system. The most prevalent of these is SQL injection but it also includes other injection techniques, including LDAP, ORM, User Agent, XML, etc. – see [[Reviewing_Code_for_OS_Injection\|Interpreter Injection]] for greater details. As a developer you should assume that all input is malicious. Before processing any input coming from a user, data source, component, or data service it should be validated for type, length, and/or range. ColdFusion includes support for Regular Expressions and CFML tags that can be used to validate input.

@@ Line 264: / Line 264: @@
 ===Selects, radio buttons, and checkboxes ===
-It is commonly held belief that the value settings for these items cannot be easily tampered. This is wrong. In the following example, actual account numbers are used, which can lead to compromise:
+It is a commonly held belief that the value settings for these items cannot be easily tampered. This is wrong. In the following example, actual account numbers are used, which can lead to compromise:
 <pre>
@@ Line 288: / Line 288: @@
-If the value is retrieved and then used directly in a SQL query, an interesting form of SQL injection may occur: authorization tampering leading to information disclosure. As the connection pool connects to the database using a single user, it may be possible to see other user's accounts if the SQL looks something like this:
+If the value is retrieved and then used directly in a SQL query, an interesting form of SQL injection may occur: authorization tampering leading to information disclosure. As the connection pool connects to the database using a single user, it may be possible to see other users' accounts if the SQL looks something like this:

@@ Line 459: / Line 459: @@
 *To handle untyped variables use IsValid() to validate its value against any legal object type that ColdFusion supports.
-*Use <cfqueryparam> and <cfprocparam> to valid dynamic SQL variables against database datatypes
+*Use <cfqueryparam> and <cfprocparam> to valid dynamic SQL variables against database datatypes.
-*Use CFLDAP for accessing LDAP servers. Avoid allowing native JNDI calls to connect to LDAP
+*Use CFLDAP for accessing LDAP servers. Avoid allowing native JNDI calls to connect to LDAP.

← Older revision		Revision as of 01:38, 4 March 2009
Line 424:		Line 424:


−	After the DOM has been read, to reduce the risk of XML, Injection use the ColdFusion XML decision functions: isXML(), isXmlAttribute(), isXmlElement(), isXmlNode(), and isXmlRoot(). The isXML() function determines if a string is well-formed XML. The other functions determine whether or not the passed parameter is a valid part of an XML document. Use the xmlValidate() function to validate external XML documents against a Document Type Definition (DTD) or XML Schema.	+	After the DOM has been read, to reduce the risk of XML Injection use the ColdFusion XML decision functions: isXML(), isXmlAttribute(), isXmlElement(), isXmlNode(), and isXmlRoot(). The isXML() function determines if a string is well-formed XML. The other functions determine whether or not the passed parameter is a valid part of an XML document. Use the xmlValidate() function to validate external XML documents against a Document Type Definition (DTD) or XML Schema.


Line 431:		Line 431:

	ColdFusion MX 7 enables Event Gateways, instant messaging (IM), and SMS (short message service) for interacting with external systems. Event Gateways are ColdFusion components that respond asynchronously to non-HTTP requests – e.g. instant messages, SMS text from wireless devices, etc. ColdFusion provides Lotus Sametime and XMPP (Extensible Messaging and Presence Protocol) gateways for instant messaging. It also provides an event gateway for interacting with SMS text messages.		ColdFusion MX 7 enables Event Gateways, instant messaging (IM), and SMS (short message service) for interacting with external systems. Event Gateways are ColdFusion components that respond asynchronously to non-HTTP requests – e.g. instant messages, SMS text from wireless devices, etc. ColdFusion provides Lotus Sametime and XMPP (Extensible Messaging and Presence Protocol) gateways for instant messaging. It also provides an event gateway for interacting with SMS text messages.
−

@@ Line 368: / Line 368: @@
 If a user marks a message for deletion, the usual way is to recover the message ID from the user, and delete that:
-''DELETE FROM message WHERE msgid='frmMsgId'''
+ DELETE FROM message WHERE msgid='frmMsgId'
 However, how do you know if the user is eligible to delete that message ID? Such tables need to be denormalized slightly to include a user ID or make it easy to perform a single query to delete the message safely. For example, by adding back an (optional) uid column, the delete is now made reasonably safe:
-''DELETE FROM message WHERE uid='session.myUserID' and msgid='frmMsgId';''
+ DELETE FROM message WHERE uid='session.myUserID' and msgid='frmMsgId';
 Where the data is potentially both a private resource and a public resource (for example, in the secure message service, broadcast messages are just a special type of private message), additional precautions need to be taken to prevent users from deleting public resources without authorization. This can be done using role based checks, as well as using SQL statements to discriminate by message type:
-''DELETE FROM message ''
+ DELETE FROM message
+ WHERE
-''WHERE''
+ uid='session.myUserID' AND
+ msgid='frmMsgId' AND
-''uid='session.myUserID' AND''
+ broadcastFlag = false;
 ==URL encoding ==

@@ Line 189: / Line 189: @@
 This is inherently unsafe and strongly discouraged. The business must sign off each and every example of no validation as the lack of validation usually leads to direct obviation of application, host and network security controls.
-''account.setAcctId(getParameter('formAcctNo'));''
+ account.setAcctId(getParameter('formAcctNo'));
-''...''
+ ...
-−
-''public setAcctId(String acctId) {''
+ public setAcctId(String acctId) {
-''	cAcctId = acctId;''
+ 	cAcctId = acctId;
-''}''
 ==Prevent parameter tampering ==

← Older revision		Revision as of 19:51, 29 October 2008
Line 154:		Line 154:

	===Sanitize===		===Sanitize===
		+
		+	Rather than accept or reject input, another option is to change the user input into an acceptable format
		+
		+	==== Sanitize with Whitelist ====
		+
		+	Any characters which are not part of an approved list can be removed, encoded or replaced.
		+
		+	Here are some examples:
		+
		+	If you expect a phone number, you can strip out all non-digit characters. Thus, "(555)123-1234", "555.123.1234", and "555\";DROP TABLE USER;--123.1234" all convert to 5551231234. Note that you should proceed to validate the resulting numbers as well. As you see, this is not only beneficial for security, but it also allows you to accept and use a wider range of valid user input.
		+
		+	If you want text from a user comment form, it is difficult to decide on a legitimate set of characters because nearly every character has a legitimate use. One solution is to replace all non alphanumeric characters with an encoded version, so "I like your web page", might emerge from your sanitation routines as "I+like+your+web+page%21". (This example uses [http://en.wikipedia.org/wiki/Url_encoding URL encoding].)
		+
		+	You can also go one step further. Say you want to set up a site where users can upload arbitrary files so they can share them or download them again from another location. In this case validation is impossible because there is no valid or invalid content. Because your only concern is protecting your app from malicious input and you don't need to actually do anything except accept, store and transmit the file, you can encode the entire file in, say [http://en.wikipedia.org/wiki/Base64 base 64].
		+
		+	==== Sanitize with Blacklist ====

	Eliminate or translate characters (such as to HTML entities or to remove quotes) in an effort to make the input "safe".		Eliminate or translate characters (such as to HTML entities or to remove quotes) in an effort to make the input "safe".

@@ Line 17: / Line 17: @@
 The most common web application security weakness is the failure to properly validate input from the client or environment. This weakness leads to almost all of the major vulnerabilities in applications, such as [[Interpreter Injection]], locale/Unicode attacks, file system attacks and buffer overflows. Data from the client should never be trusted for the client has every possibility to tamper with the data.
-In many cases, [[Encoding]] has the potential to defuse attacks that rely on lack of input validation. For example, if you use HTML entity encoding on user input before it is sent to a browser, it will prevent most [[Cross-site scripting|XSS]] attacks. However, simply preventing attacks is not enough - you must perform [[Intrusion Detection]] in your applications. Otherwise, you are allowing attackers to repeatedly attack your application until they find a vulnerability that you haven't protected against. Detecting attempts to find these weaknesses is a critical protection mechanism.
+In many cases, [[Encoding]] has the potential to defuse attacks that rely on lack of input validation. For example, if you use HTML entity encoding on user input before it is sent to a browser, it will prevent most [[Cross-site Scripting (XSS)|XSS]] attacks. However, simply preventing attacks is not enough - you must perform [[Intrusion Detection]] in your applications. Otherwise, you are allowing attackers to repeatedly attack your application until they find a vulnerability that you haven't protected against. Detecting attempts to find these weaknesses is a critical protection mechanism.
 ==Definitions ==

← Older revision		Revision as of 15:16, 3 September 2008
Line 391:		Line 391:
	==Data Validation and Interpreter Injection ==		==Data Validation and Interpreter Injection ==

−	This section focuses on preventing injection in ColdFusion. Interpreter Injection involves manipulating application parameters to execute malicious code on the system. The most prevalent of these is SQL injection but it also includes other injection techniques, including LDAP, ORM, User Agent, XML, etc. – see the Interpreter Injection chapter of this document for greater details. As a developer you should assume that all input is malicious. Before processing any input coming from a user, data source, component, or data service it should be validated for type, length, and/or range. ColdFusion includes support for Regular Expressions and CFML tags that can be used to validate input.	+	This section focuses on preventing injection in ColdFusion. Interpreter Injection involves manipulating application parameters to execute malicious code on the system. The most prevalent of these is SQL injection but it also includes other injection techniques, including LDAP, ORM, User Agent, XML, etc. – see the [[Reviewing_Code_for_OS_Injection\|Interpreter Injection]] chapter of this document for greater details. As a developer you should assume that all input is malicious. Before processing any input coming from a user, data source, component, or data service it should be validated for type, length, and/or range. ColdFusion includes support for Regular Expressions and CFML tags that can be used to validate input.