49 lines
1.9 KiB
Plaintext
49 lines
1.9 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
== Noncompliant Code Example
|
|
|
|
For https://docs.microsoft.com/en-us/dotnet/api/system.xml.serialization.xmlserializer?view=netframework-4.8[XmlSerializer ] serializer, the expected type should not come from user-controlled input:
|
|
|
|
----
|
|
public class XmlSerializerTestCase : Controller
|
|
{
|
|
public ActionResult unsecuredeserialization(string typeName)
|
|
{
|
|
// ....
|
|
ExpectedType obj = null;
|
|
Type t = Type.GetType(typeName); // typeName is user-controlled
|
|
XmlSerializer serializer = new XmlSerializer(t); // Noncompliant
|
|
obj = (ExpectedType) serializer.Deserialize(fs);
|
|
// ....
|
|
}
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
For https://docs.microsoft.com/en-us/dotnet/api/system.xml.serialization.xmlserializer?view=netframework-4.8[XmlSerializer ] serializer:
|
|
|
|
----
|
|
public class XmlSerializerTestCase : Controller
|
|
{
|
|
public ActionResult securedeserialization()
|
|
{
|
|
// ....
|
|
ExpectedType obj = null;
|
|
XmlSerializer serializer = new XmlSerializer(typeof(ExpectedType)); // Compliant
|
|
obj = (ExpectedType) serializer.Deserialize(fs);
|
|
// ....
|
|
}
|
|
}
|
|
----
|
|
|
|
== See
|
|
|
|
* https://media.blackhat.com/bh-us-12/Briefings/Forshaw/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf[Are You My Type?] - James Forshaw - BlackHat 2012
|
|
* https://www.youtube.com/watch?v=oxlD8VWWHE8[BlueHat v17 - Dangerous Contents - Securing .Net Deserialization]
|
|
* https://www.youtube.com/watch?v=qDoBlLwREYk0[Alvaro Muñoz: .NET Serialization: Detecting and Defending Vulnerable Endpoints]
|
|
* https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization[OWASP Top 10 2017 Category A8] - Insecure Deserialization
|
|
* https://cwe.mitre.org/data/definitions/134.html[MITRE, CWE-134] - Use of Externally-Controlled Format String
|
|
* https://cwe.mitre.org/data/definitions/502.html[MITRE, CWE-502] - Deserialization of Untrusted Data
|
|
* https://www.sans.org/top25-software-errors/#cat2[SANS Top 25] - Risky Resource Management
|