Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 619●Does your class validate data streams?If your code includes a method that receives a serialized data stream, check thatevery field is validated as it is read from the data stream.Do You Use Reflection?To help locate code that uses reflection, search for “System.Reflection”— this is thenamespace that contains the reflection types. If you do use reflection, review thefollowing questions to help identify potential vulnerabilities:● Do you dynamically load assemblies?If your code loads assemblies to create object instances and invoke types, does itobtain the assembly or type name from input data? If so, check that the code isprotected with a permission demand to ensure all calling code is authorized. Forexample, use a StrongNameIdentity permission demand or demand full trust.●●Do you create code dynamically at runtime?If your assemblies dynamically generate code to perform operations for a caller,check that the caller is in no way able to influence the code that is generated. Forexample, does your code generation rely on caller-supplied input parameters?This should be avoided, or if it is absolutely necessary, make sure that the input isvalidated and that it cannot be used to adversely affect code generation.Do you use reflection on other types?If so, check that only trusted code can call you. Use code access securitypermission demands to authorize calling code.Do You Handle Exceptions?Secure exception handling is required for robust code, to ensure that sufficientexception details are logged to aid problem diagnosis and to help prevent internalsystem details being revealed to the client. Review the following questions to helpidentify potential exception handling vulnerabilities:● Do you fail early?Check that your code fails early to avoid unnecessary processing that consumesresources. If your code does fail, check that the resulting error does not allow auser to bypass security checks to run privileged code.● How do you handle exceptions?Avoid revealing system or application details to the caller. For example, do notreturn a call stack to the end user. Wrap resource access or operations that couldgenerate exceptions with try/catch blocks. Only handle the exceptions you knowhow to handle and avoid wrapping specific exceptions with generic wrappers.