51369b610e
When an include is not surrounded by empty lines, its content is inlined on the same line as the adjacent content. That can lead to broken tags and other display issues. This PR fixes all such includes and introduces a validation step that forbids introducing the same problem again.
75 lines
1.9 KiB
Plaintext
75 lines
1.9 KiB
Plaintext
Exposing HTTP endpoints is security-sensitive. It has led in the past to the following vulnerabilities:
|
|
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3072[CVE-2016-3072]
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3175[CVE-2015-3175]
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0218[CVE-2003-0218]
|
|
|
|
HTTP endpoints are webservices' main entrypoint. Attackers will take advantage of any vulnerability by sending crafted inputs for headers (including cookies), body and URI. No input should be trusted and extreme care should be taken with all returned value (header, body and status code).
|
|
|
|
|
|
This rule flags code which creates HTTP endpoint via .Net Framework MVC Controllers. It guides security code reviews to security-sensitive code.
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
Public Class Foo
|
|
Inherits System.Web.Mvc.Controller
|
|
|
|
Public Property MyProperty As String
|
|
Get
|
|
Return "test"
|
|
End Get
|
|
Set(ByVal value As String)
|
|
End Set
|
|
End Property
|
|
|
|
Public Sub New()
|
|
End Sub
|
|
|
|
Public Sub PublicFoo() ' Sensitive. Public Controller methods are exposed as HTTP endpoints.
|
|
End Sub
|
|
|
|
<System.Web.Mvc.NonAction>
|
|
Public Sub NotAnEndpoint() ' This is not an endpoint because of the NonAction attribute.
|
|
End Sub
|
|
|
|
Protected Sub ProtectedFoo()
|
|
End Sub
|
|
|
|
Friend Sub InternalFoo()
|
|
End Sub
|
|
|
|
Private Sub PrivateFoo()
|
|
End Sub
|
|
|
|
Private Class Bar
|
|
Inherits System.Web.Mvc.Controller
|
|
|
|
Public Sub InnerFoo()
|
|
End Sub
|
|
End Class
|
|
End Class
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|