Improving Web Application Security: Threats and - CGISecurity

270 Part III: Building Secure Web Applications(continued)}}// Validate the supplied nameif ( !RegEx.Match(Request.Form["name"],@"[A-Za-z'\- ]",RegexOptions.None).Success){// Invalid name}Validating Input Used for Data AccessIf you are generating dynamic SQL queries based on user input, a SQL injectionattack can inject malicious SQL commands that can be executed by the database. In atypical Web-based data access scenario, the following defense in depth strategy canbe used:● Use regular expressions to constrain input within your page class.●●Sanitize or reject input. For defense in depth, you can choose to use a helpermethod to strip null characters or other known bad characters.Use parameterized stored procedures for data access to ensure that type andlength checks are performed on the data used in SQL queries.For more information about using parameters for data access and about writingsecure data access code, see Chapter 14, “Building Secure Data Access.”Validating Input Used For File I/OIn general, you should avoid writing code that accepts file input or path input fromthe caller. Instead, use fixed file names and locations when reading and writing data.This ensures that your code cannot be coerced into accessing arbitrary files. It alsoensures that your code is not vulnerable to canonicalization bugs.If you do need to accept input file names, there are two main challenges. First, is theresulting file path and name a valid file system name? Second, is the path valid in thecontext of your application? For example, is it beneath the application’s virtualdirectory root?To canonicalize the file name, use System.IO.Path.GetFullPath. To check that the filepath is valid in the context of your application, you can use .NET code access securityto grant the precise FileIOPermission to your code so that is able to access only filesfrom specific directories. For more information, see the “File I/O” sections inChapter 7, “Building Secure Assemblies” and Chapter 8, “Code Access Security inPractice.”