Improving Web Application Security: Threats and - CGISecurity

28 Part I: Introduction to Threats and CountermeasuresThis results in the following statement being submitted to the database for execution.SELECT * FROM Users WHERE UserName=''; DROP TABLE Customers --'This deletes the Customers table, assuming that the application’s login has sufficientpermissions in the database (another reason to use a least privileged login in thedatabase). The double dash (--) denotes a SQL comment and is used to comment outany other characters added by the programmer, such as the trailing quote.Note The semicolon is not actually required. SQL Server will execute two commands separated byspaces.Other more subtle tricks can be performed. Supplying this input to the txtuid field:' OR 1=1 -builds this command:SELECT * FROM Users WHERE UserName='' OR 1=1 -Because 1=1 is always true, the attacker retrieves every row of data from the Userstable.Countermeasures to prevent SQL injection include:● Perform thorough input validation. Your application should validate its inputprior to sending a request to the database.● Use parameterized stored procedures for database access to ensure that inputstrings are not treated as executable statements. If you cannot use storedprocedures, use SQL parameters when you build SQL commands.● Use least privileged accounts to connect to the database.CanonicalizationDifferent forms of input that resolve to the same standard name (the canonical name),is referred to as canonicalization. Code is particularly susceptible to canonicalizationissues if it makes security decisions based on the name of a resource that is passed tothe program as input. Files, paths, and URLs are resource types that are vulnerable tocanonicalization because in each case there are many different ways to represent thesame name. File names are also problematic. For example, a single file could berepresented as:c:\temp\somefile.datsomefile.datc:\temp\subdir\..\somefile.datc:\ temp\ somefile.dat..\somefile.dat