Enterprise Library Test Guide - Willy .Net

140
Enterprise Library Test Guide
Table 24 lists the DREAD rating for threat 9.
Table 24: Threat 9 DREAD Rating
D R E A D Total Rating
3 3 2 3 3 14 High
Table 25 lists details about threat 10.
Table 25: Logging Application Block Threat 10
Threat 10
Name
Entry points
Threat
description
Countermeasures
STRIDE
classification
Risk
Mitigation
Investigative
notes
Input validation is not performed
The Logging Application Block does not perform input validation.
Public classes and static methods
The Logger class exposes the static Write method. This method accepts a
log message as a parameter. However, it does not perform input validation
on the message to check for NULL values. An invalid input can cause the
application block to throw an unhandled exception to the application.
The application block must perform input validation. For details, see the
investigative notes for threat 9.
Information Disclosure
High
No
See threat 9.
Table 26 lists the DREAD rating for threat 10.
Table 26: Threat 10 DREAD Rating
D R E A D Total Rating
3 3 2 3 3 14 High
Table 27 lists details about threat 11.
Table 27: Logging Application Block Threat 11
Threat 11
Name
Entry points
Threat description
Countermeasures
Altering the log file’s directory path in the configuration file
Flat file path canonical input validation
Configuration files, custom configuration stores
The Logging Application Block allows you to log messages to a flat file.
The location of this file is included in the configuration file or custom configuration
source. An attacker can change the file’s directory path to point
away from the flat file and to a system file. The attacker can then send
harmful log messages to that system file.
The application block should only log messages to a file in the current
directory. All log files should have a .txt file name extension.