Improving Web Application Security: Threats and - CGISecurity

168 Part III: Building Secure Web ApplicationsUnmanaged CodeIf you have existing COM components or Win32 DLLs that you want to reuse, use thePlatform Invocation Services (P/Invoke) or COM Interop layers. When you callunmanaged code, it is vital that your managed code validates each input parameterpassed to the unmanaged API to guard against potential buffer overflows. Also, becareful when handling output parameters passed back from the unmanaged API.You should isolate calls to unmanaged code in a separate wrapper assembly. Thisallows you to sandbox the highly privileged code and to isolate the code accesssecurity permission requirements to a specific assembly. For more details aboutsandboxing and about additional code access security related guidelines that youshould apply when calling unmanaged code, see “Unmanaged Code” in Chapter 8,“Code Access Security in Practice.” The following recommendations help improvethe security of your unmanaged API calls, without using explicit code access securitycoding techniques:● Validate input and output string parameters.●●●●Validate array bounds.Check file path lengths.Compile unmanaged code with the /GS switch.Inspect unmanaged code for “dangerous” APIs.Validate Input and Output String ParametersString parameters passed to unmanaged APIs are a prime source of buffer overflows.Check the length of any input string inside your wrapper code to ensure it does notexceed the limit defined by the unmanaged API. If the unmanaged API accepts acharacter pointer you may not know the maximum permitted string length, unlessyou have access to the unmanaged source. For example, the following is a commonvulnerability.void SomeFunction( char *pszInput ){char szBuffer[10];// Look out, no length checks. Input is copied straight into the buffer// Check length or use strncpystrcpy(szBuffer, pszInput);. . .}If you cannot examine the unmanaged code because you do not own it, make surethat you rigorously test the API by passing in deliberately long input strings.If your code uses a StringBuilder to receive a string passed from an unmanaged API,make sure that it can hold the longest string that the unmanaged API can hand back.