Improving Web Application Security: Threats and - CGISecurity

354 Part III: Building Secure Web ApplicationsInput ValidationIn trusted server scenarios in which remoting solutions should be used, front-endWeb applications generally perform input validation. The data is fully validatedbefore it is passed to the remoted components. If you can guarantee that the datapassed to a remoted component can only come from within the current trustboundary, you can let the upstream code perform the input validation.If, however, your remoting solution can be accessed by arbitrary client applicationsrunning in the enterprise, your remote components should validate input and bewary of serialization attacks and MarshalByRefObject attacks.Serialization AttacksYou can pass object parameters to remote components either by using the call contextor by passing them through regular input parameters to the methods that areexposed by the remote component. It is possible for a malicious client to serialize anobject and then pass it to a remote component with the explicit intention of trippingup the remote component or causing it to perform an unintended operation. Unlessyou can trust the client, you should carefully validate each field item in thedeserialized object, because the object parameter is created on the server.MarshalByRefObject AttacksObjects that derive from System.MarshalByRefObject require a URL in order tomake call backs to the client. It is possible for the callback URL to be spoofed so thatthe server connects to a different client computer, for example, a computer behind afirewall.You can mitigate the risk of serialization and MarshalByRefObject attacks withversion 1.1 of the .NET Framework by setting the typeFilterLevel attribute on the element to Low. This instructs the .NET Framework remotinginfrastructure to only serialize those objects it needs in order to perform the methodinvocation, and to reject any custom objects that support serialization that you createand put in the call context or pass as parameters. You can configure this setting inWeb.config or programmatically as shown below.orBinaryServerFormatterSinkProvider provider = newBinaryServerFormatterSinkProvider();provider.TypeFilterLevel = TypeFilterLevel.Low;