SQL Injection Attacks and Defense - 2009

Application Filters
Platform-Level Defenses • Chapter 9 389
You also can implement filters in the Web application’s programming language or
framework. The architecture is similar to that of Web server plug-ins: Modular code executes
as requests and responses pass through a series of phases. You can use the ASP.NET System.
Web.IHttpModule interface and the javax.servlet.Filter interface to implement the filter pattern.
You can then add them to an application without code changes and activate them
declaratively in the application configuration file. Figure 9.8 shows an example code snippet
of the doFilter method of a custom J2EE Filter class. This method is called for each request/
response pair due to a request for a J2EE Web resource ( JSP file, servlet, etc.).
Figure 9.8 Code Snippet of a Custom J2EE Filter Class
public class SqlInjDetectionFilter implements Filter {
}
public void doFilter(ServletRequest req, ServletResponse res,
{
chain filterChain) throws IOException, ServletException
// Check request data for malicious characters
doDetectSqlI(req, res);
// Call next filter in the chain
chain.doFilter(servletRequest, servletResponse);
}
In terms of runtime protection, application filters are really nice because they can be
developed independent of the application, deployed as a stand-alone .dll or .jar file,
and turned on immediately. This means this solution can be deployed more quickly in
certain organizations because Web server configuration changes are not required (in many
organizations, application developers do not have access to the Web servers and so must
coordinate with the Web server team to make the configuration changes associated with a
Web server filter). Because these filters are implemented in the same programming language
as the application, they can extend or closely wrap existing application behavior. For this
same reason, their utility is limited to applications built on the same framework (refer to the
Tools and Traps sidebar, “Protecting Web Applications with ASP.NET and IIS,” for
information on how you can overcome this limitation).
Similar to Web server filters, application filters allow you to add security features, such as
malicious request detection, prevention, and logging, to vulnerable Web applications. Because
they can be written in feature-rich object-oriented languages such as Java and C#, they are
usually less complex to code and do not introduce new vulnerability classes such as buffer
overflows. OWASP Stinger and Secure Parameter Filter (SPF) are free application filters that