the-web-application-hackers-handbook

Chapter 19 n Finding Vulnerabilities in Source Code 705
string, because it already contains valid HTML markup. Any attempt to sanitize
the data would break the application by encoding the HTML that the application
itself has specified. Hence, the example is certainly vulnerable unless filters are
in place elsewhere that block requests containing XSS exploits within the query
string. This filter-based approach to stopping XSS attacks is often flawed. If it
is present, you should closely review it to identify any ways to work around it
(see Chapter 12).
In more subtle cases, user-controllable data is used to set the value of a variable
that is later used to build the response to the user. Here, the class member
variable m_pageTitle is set to a value taken from the request query string. It
will presumably be used later to create the element within the returned
HTML page:
private void setPageTitle(HttpServletRequest request) throws
ServletException
{
String requestType = request.getParameter(“type”);
if (“3”.equals(requestType) && null!=request.getParameter(“title”))
m_pageTitle = request.getParameter(“title”);
}
else m_pageTitle = “Online banking application”;
When you encounter code like this, you should closely review the processing
subsequently performed on the m_pageTitle variable. You should see how it is
incorporated into the returned page to determine whether the data is suitably
encoded to prevent XSS attacks.
The preceding example clearly demonstrates the value of a code review in
finding some vulnerabilities. The XSS flaw can be triggered only if a different
parameter (type) has a specific value (3). Standard fuzz testing and vulnerability
scanning of the relevant request may well fail to detect the vulnerability.
SQL Injection
SQL injection vulnerabilities most commonly arise when various hard-coded
strings are concatenated with user-controllable data to form a SQL query, which
is then executed within the database. Here, a query is constructed using data
taken directly from the request query string:
StringBuilder SqlQuery = newStringBuilder(“SELECT name, accno FROM
TblCustomers WHERE “ + SqlWhere);
if(Request.QueryString[“CID”] != null &&
Request.QueryString[“PageId”] == “2”)
{
SqlQuery.Append(“ AND CustomerID = “);