Improving Web Application Security: Threats and - CGISecurity

Contents xxxiASP.NET Architecture on Windows Server 2003 ........................................................ 592Configuring ACLs for Network Service ................................................................... 593Isolating Applications by Identity .............................................................................. 594Anonymous Account Impersonation ...................................................................... 595Fixed Identity Impersonation ................................................................................ 597Isolating Applications with Application Pools ............................................................. 599Isolating Applications with Code Access Security ....................................................... 600Forms Authentication Issues.................................................................................... 601UNC Share Hosting ................................................................................................. 601Summary ............................................................................................................... 602Part VAssessing Your Security 603Chapter 21Code Review 605In This Chapter ....................................................................................................... 605Overview ................................................................................................................ 605FxCop .................................................................................................................... 606Performing Text Searches ........................................................................................ 606Search for Hard-Coded Strings ............................................................................. 606ILDASM.............................................................................................................. 607Cross-Site Scripting (XSS)........................................................................................ 608Identify Code That Outputs Input .......................................................................... 609Identify Potentially Dangerous HTML Tags and Attributes........................................ 610Identify Code That Handles URLs ......................................................................... 611Check That Output Is Encoded ............................................................................. 612Check for Correct Character Encoding................................................................... 612Check the validateRequest Attribute..................................................................... 612Check the HttpOnly Cookie Option........................................................................ 613Check the Security Attribute ................................................................... 613Check the Use of the innerText and innerHTML Properties...................................... 613More Information ................................................................................................ 613SQL Injection .......................................................................................................... 614Buffer Overflows ..................................................................................................... 615Managed Code ....................................................................................................... 616Is Your Class Design Secure? .............................................................................. 617Do You Create Threads? ...................................................................................... 617Do You Use Serialization?.................................................................................... 618Do You Use Reflection? ....................................................................................... 619Do You Handle Exceptions? ................................................................................. 619Do You Use Cryptography?................................................................................... 620Do You Store Secrets? ........................................................................................ 621Do You Use Delegates?....................................................................................... 622