security - Open Redirect or Header Manipulation issues from Fortify scan on asp.net -

-

we did fortify scan on our asp.net application. found there many header manipulation issues. issues pointing response.redirect(). please have @ below code encoded parameters. below code counted header manipulation issue.

            int icount = 0;             foreach (string name in request.querystring.keys)             {                 icount++;                 if (icount > 1)                 {                     url += "&";                 }                 url += name;                 if (request.params[name]!=null)                 {                     url += "=" + antixss.urlencode(request.params[name]);                 }             }             response.redirect(server.urlpathencode(page.root) + "\test.aspx?" + url);

can body let me know else required change here resolve issue?

take off server.urlpathencode(page.root) portion , use server.transfer() instead of response.redirect().

server.transfer() transfers user page on same site , poses little no danger of accidentally directing site.

response.redirect() when want redirect site.

also, fortify doesn't tend request.params[] due possible ambiguity. careful attacker may able, on servers, send utf-7 or non-printing version of name 1 of request variables , let name of variable contain actual xss injection, or overwrite get-request value cookie of same name. make sure both name , value htmlencoded, , consider using request.querystring[parametername] instead of request.params[parametername] avoid more issues fortify.

hopefully gets past fortify issues!


Comments

Post a Comment

Popular posts from this blog

javascript - how to protect a flash video from refresh？ -

-
<!doctype html> <html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <title>flash video refresh</title> </head> <body> <div id="playerzone"><embed height="496" width="580" flashvars="flvid=19742822&amp;createtime=2012-4-19 13:46:33" wmode="opaque" allowscriptaccess="always" allowfullscreen="true" quality="high" bgcolor="#000000" name="player" id="player" src="swf/mine.swf" type="application/x-shockwave-flash"></div> <a onclick="return test();" id="test">click me popup div,and hide scrollbar</a> </body> the code upon： for example,when click a#test button,popup div,it's no problem,but want hide scrollbar while div popup. i used $('html').css('overflow','hidden') in
Read more

android - Associate same looper with different threads -

-
Image
in application, want create multiple threads working on single queue. create queue know need call looper.prepare() . i want other threads create should associated looper created first thread, how can achieve this? use 1 of java thread safe queue class java.util.concurrent package instead of looper achieve goal. it's more common practice. share queue between threads , post task queue entry 1 thread can entry thread. blockingqueue can - in 1 thread call take() , block thread until thread put() entry queue. that's all. producer consumer pattern example blockingqueue or concurrentlinkedqueue about blockingqueue
Read more

visual studio 2010 - Connect to informix database windows form application -

-
i trying figure out how connect ibm informix database. have been doing research , have found threads 5 years ago examples not working. i have installed latest sdk ibm informix. i have included ibm.data.informix.dll references in project. i have included using ibm.data.informix; i adding button , on click testing conenction. debug error "sql0035n file "c:\users\adam\documents\visual studio 2010\projects\test\test\msg\en_us\db2nmp.xml" cannot opened." this file not exist , dont see anywhere in program files (x86)\ibm informix client sdk directory. my on click code is private void button1_click(object sender, eventargs e) { const string host = "192.168.obfuscated"; const string servicenum = "1525"; //port? const string server = "serverobfuscated"; const string database = "dbobfuscatedy"; const string user = "myusername"; const string password = &
Read more