Improving Web Application Security: Threats and - CGISecurity

Chapter 12: Building Secure Web Services 331Table 12.1 XSD Schema Element Examples (continued)DescriptionExampleConstraining input to values defined by anenumerated typeFor more information, see Microsoft Knowledge Base articles:●●307379, “How To: Validate an XML Document by Using DTD, XDR, or XSDin Visual C# .NET.”318504, “How To: Validate XML Fragments Against an XML Schema inVisual C#.NET.”SQL InjectionSQL injection allows an attacker to execute arbitrary commands in the database usingthe Web service’s database login. SQL injection is a potential issue for Web services ifthe services use input data to construct SQL queries. If your Web methods access thedatabase, they should do so using SQL parameters and ideally, parameterized storedprocedures. SQL parameters validate the input for type and length, and they ensurethat the input is treated as literal text and not executable code. For more informationabout this and other SQL injection countermeasures, see the “Input Validation”section in Chapter 14, “Building Secure Data Access.”Cross-Site ScriptingWith cross-site scripting (XSS), an attacker exploits your application to executemalicious script at the client. If you call a Web service from a Web application andsend the output from the Web service back to the client in an HTML data stream,XSS is a potential issue. In this scenario, you should encode the output receivedfrom the Web service in the Web application before returning it to the client. This isparticularly important if you do not own the Web service and it falls outside the Webapplication’s trust boundary. For more information about XSS countermeasures, seethe “Input Validation” section in Chapter 10, “Building Secure ASP.NET Pages andControls.”