Improving Web Application Security: Threats and - CGISecurity

616 Part V: Assessing Your Security4. Check output strings.Check if your code uses a StringBuilder to receive a string passed back from anunmanaged API. Check that the capacity of the StringBuilder is long enough tohold the longest string the unmanaged API can hand back, because the stringcoming back from unmanaged code could be of arbitrary length.5. Check array bounds.If you use an array to pass input to an unmanaged API, check that the managedwrapper verifies that the array capacity is not exceeded.6. Check that your unmanaged code is compiled with the /GS switch.If you own the unmanaged code, use the /GS switch to enable stack probes todetect some kinds of buffer overflows.Managed CodeUse the review questions in this section to analyze your entire managed source codebase. The review questions apply regardless of the type of assembly. This sectionhelps you identify common managed code vulnerabilities. For more informationabout the issues raised in this section and for code samples that illustratevulnerabilities, see Chapter 7, “Building Secure Assemblies.”If your managed code uses explicit code access security features, see “Code AccessSecurity” later in this chapter for additional review points. The following reviewquestions help you to identify managed code vulnerabilities:● Is your class design secure?● Do you create threads?● Do you use serialization?● Do you use reflection?● Do you handle exceptions?● Do you use cryptography?● Do you store secrets?● Do you use delegates?