Improving Web Application Security: Threats and - CGISecurity

xivImproving Web Application Security: Threats and CountermeasuresRegistry ................................................................................................................. 166HKEY_LOCAL_MACHINE....................................................................................... 166HKEY_CURRENT_USER........................................................................................ 166Reading from the Registry ................................................................................... 167Data Access ........................................................................................................... 167Unmanaged Code ................................................................................................... 168Validate Input and Output String Parameters ......................................................... 168Validate Array Bounds ......................................................................................... 169Check File Path Lengths ...................................................................................... 169Compile Unmanaged Code With the /GS Switch .................................................... 169Inspect Unmanaged Code for Dangerous APIs....................................................... 169Delegates............................................................................................................... 169Do Not Accept Delegates from Untrusted Sources................................................. 169Serialization ........................................................................................................... 170Do Not Serialize Sensitive Data............................................................................ 170Validate Serialized Data Streams ......................................................................... 170Partial Trust Considerations ................................................................................. 171Threading ............................................................................................................... 171Do Not Cache the Results of Security Checks ....................................................... 171Consider Impersonation Tokens ........................................................................... 172Synchronize Static Class Constructors.................................................................. 172Synchronize Dispose Methods ............................................................................. 172Reflection............................................................................................................... 172Obfuscation............................................................................................................ 173Cryptography .......................................................................................................... 174Use Platform-provided Cryptographic Services ....................................................... 174Key Generation ................................................................................................... 174Key Storage........................................................................................................ 176Key Exchange ..................................................................................................... 178Key Maintenance ................................................................................................ 178Summary ............................................................................................................... 179Additional Resources .............................................................................................. 179Chapter 8Code Access Security in Practice 181In This Chapter ....................................................................................................... 181Overview ................................................................................................................ 181How to Use This Chapter ......................................................................................... 182Code Access Security Explained............................................................................... 182Code.................................................................................................................. 183Evidence ............................................................................................................ 183Permissions ....................................................................................................... 184Assert, Deny, and PermitOnly Methods.................................................................. 185Policy ................................................................................................................. 185Code Groups ...................................................................................................... 186