SQL Injection Attacks and Defense - 2009

392 Chapter 9 • Platform-Level Defenses
then focus your efforts on comprehensively validating the editable inputs, which is usually
a much more manageable task.
Examples of technologies that implement this strategy are HTTP Data Integrity
Validator (HDIV) and SPF. You can use HDIV to protect most J2EE Web applications that
follow the Model-View-Controller (MVC) pattern and you can download it at www.hdiv.
org. You can use SPF to protect ASP.NET Web applications when run on IIS 6.0; however,
it can be leveraged to protect virtually any Web application when run on IIS 7.0. Refer to
the Tools and Traps sidebar, “Protecting Web Applications with ASP.NET and IIS,” for more
information. You can download SPF at www.gdssecurity.com/l/spf/.
URL/Page-Level Strategies
Let’s look at some other techniques for virtual-patching a vulnerable URL or page without
changing the source code.
Page Overriding
If a page is vulnerable and needs replacing, you can create a replacement page or class that
is substituted at runtime. The substitution is accomplished with configuration in the Web
application’s configuration file. In ASP.NET applications, you can use HTTP handlers to
accomplish this task.
Figure 9.9 shows a custom HTTP handler configured to handle requests to
PageVulnToSqlI.aspx instead of the vulnerable page itself. The substituted handler class
implements the logic of the original page in a secure manner. This could include stringent
validation of request parameters and the use of secure data access objects.
Figure 9.9 Configuring an HTTP Handler in web.config
You can use a similar approach in the deployment descriptor of a J2EE Web application.
You can map the vulnerable URL to a servlet that handles the request in a secure manner, as
shown in Figure 9.10.