Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 293Validate Input ParametersValidate all input parameters that come from form fields, query strings, cookies, andHTTP headers. The System.Text.RegularExpressions.Regex class helps validateinput parameters. For example, the following code shows how to use this class tovalidate a name passed through a query string parameter. The same technique can beused to validate other forms of input parameter, for example, from cookies or formfields. For example, to validate a cookie parameter, use Request.Cookies instead ofRequest.QueryString.using System.Text.RegularExpressions;. . .private void Page_Load(object sender, System.EventArgs e){// Name must contain between 1 and 40 alphanumeric characters// together with (optionally) special characters '`´ for names such// as D'Angeloif (!Regex.IsMatch(Request.QueryString["name"],@"^[\p{L}\p{Zs}\p{Lu}\p{Ll}]{1,40}$"))throw new Exception("Invalid name parameter");// Use individual regular expressions to validate all other// query string parameters. . .}For more information about using regular expressions and how to validate inputdata, see “Input Validation” earlier in this chapter.Exception ManagementCorrect exception handling in your Web pages prevents sensitive exception detailsfrom being revealed to the user. The following recommendations apply to ASP.NETWeb pages and controls.● Return generic error pages to the client.●Implement page-level or application-level error handlers.For more information about exception management, see Chapter 7, “Building SecureAssemblies.”Return Generic Error Pages to the ClientIn the event of an unhandled exception, that is, one that propagates to the applicationboundary, return a generic error page to the user. To do this, configure the element as follows: