Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 639Do You Pass Objects as Parameters?If you use the TcpChannel and your component API accepts custom objectparameters, or if custom objects are passed through the call context, your code hastwo security vulnerabilities.● If the object passed as a parameter derives from System.MarshalByRefObject, itis passed by reference. In this case, the object requires a URL to support call backsto the client. It is possible for the client URL to be spoofed, which can result in acall back to an alternate computer.● If the object passed as a parameter supports serialization, the object is passed byvalue. In this instance, check that your code validates each field item as it isdeserialized on the server to prevent the injection of malicious data.To prevent custom objects being passed to your remote component either byreference or by value, set the TypeFilterLevel property on your server-side formatterchannel sink to TypeFilterLevel.Low.To locate objects that are passed in the call context, search for the“ILogicalThreadAffinative” string. Only objects that implement this interface can bepassed in the call context.Do You Use Custom Authentication and Principal Objects?If you use custom authentication, do you rely on principal objects passed from theclient? This is potentially dangerous because malicious code could create a principalobject that contains extended roles to elevate privileges. If you use this approach,check that you only use it with out-of-band mechanisms such as IPSec policies thatrestrict the client computers that can connect to your component.How Do You Configure Proxy Credentials?Review how your client code configures credentials on the remoting proxy. If explicitcredentials are used, where are those credentials maintained? They should beencrypted and stored in a secure location such as a restricted registry key. Theyshould not be hard-coded in plain text. Ideally, your client code should use the clientprocess token and use default credentials.