Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 139
Threat 9
Investigative
notes
Attackers can flood WMI event instrumentation with false events.
The following code examples show how the application block should first
validate the input to the Logger.Write method before it raises an event.
public static void Write(object message, ICollection
categories, int priority, int eventId, TraceEventType severity,
string title, IDictionary properties)
{
LogEntry log = new LogEntry();
//input validation should have been done here for message
log.Message = message.ToString();
log.Categories = categories;
log.Priority = priority;
log.EventId = eventId;
log.Severity = severity;
log.Title = title;
log.ExtendedProperties = properties;
Write(log);
}
The following examples show other places that require input validation.
Logger.Write(object,..) for message
SoapLogFormatter. DeserializeLogEntry(string) for serialized-
LogEntry
ContextItems.ProcessContextItems(LogEntry) for log
LoggingSettings.GetLoggingSettings(IConfigurationSource) for
configurationSource
ComPlusInformationProvider.PopulateDictionary(IDictionary) for
dict
DebugInformationProvider.PopulateDictionary(IDictionary) for
dict
ManagedSecurityContextInformationProvider.PopulateDictionary(I
Dictionary) for dict
UnmanagedSecurityContextInformationProvider.PopulateDictionary
(IDictionary) for dict
DebugUtils.GetStackTraceWithSourceInfo(StackTrace) for stack-
Trace
PriorityFilter.Filter(LogEntry) for log
DictionaryToken.FormatToken(String, LogEntry) for log
KeyValueToken.FormatToken(String, LogEntry) for log
TimeStampToken.FormatToken(String, LogEntry) for log
TokenFunction.Format(StringBuilder, LogEntry) for message-
Builder
FormatterDatabaseTraceListener.ValidateParameters(LogEntry)
for logEntry
MsmqListener.MsmqListener(DistributorService, Int32, String)
for distributorService
MsmqDistributorSettings.GetSettings(IConfigurationSource) for
configurationSource