Improving Web Application Security: Threats and - CGISecurity

612 Part V: Assessing Your SecurityCheck That Output Is EncodedWhile not a replacement for checking that input is well-formed and correct, youshould check that HtmlEncode is used to encode HTML output that includes anytype of input. Also check that UrlEncode is used to encode URL strings. Input datacan come from query strings, form fields, cookies, HTTP headers, and input readfrom a database, particularly if the database is shared by other applications. Byencoding the data, you prevent the browser from treating the HTML as executablescript.Check for Correct Character EncodingTo help prevent attackers using canonicalization and multi-byte escape sequences totrick your input validation routines, check that the character encoding is set correctlyto limit the way in which input can be represented.Check that the application Web.config file has set the requestEncoding andresponseEncoding attributes configured by the element as shownbelow.Character encoding can also be set at the page level using a tag orResponseEncoding page-level attribute as shown below.For more information, see Chapter 10, “Building Secure ASP.NET Pages andControls.”Check the validateRequest AttributeWeb applications that are built using the .NET Framework version 1.1 perform inputfiltering to eliminate potentially malicious input, such as embedded script. Do notrely on this, but use it for defense in depth. Check the element in yourconfiguration file to confirm that the validateRequest attribute is set to true. This canalso be set as a page-level attribute. Scan your .aspx source files for validateRequest,and check that it is not set to false for any page.