98 lines
2.4 KiB
Plaintext
98 lines
2.4 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
== Noncompliant Code Example
|
|
|
|
[source,csharp]
|
|
----
|
|
using System.IO;
|
|
using System.Net;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
|
|
namespace WebApplicationDotNetCore.Controllers
|
|
{
|
|
public class RSPEC5144SSRFNoncompliantController : Controller
|
|
{
|
|
public IActionResult Index()
|
|
{
|
|
return View();
|
|
}
|
|
|
|
public IActionResult ReadContentOfURL(string url)
|
|
{
|
|
HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url); // Noncompliant
|
|
|
|
HttpWebResponse response = (HttpWebResponse)request.GetResponse();
|
|
Stream dataStream = response.GetResponseStream();
|
|
StreamReader reader = new StreamReader(dataStream);
|
|
string responseFromServer = reader.ReadToEnd();
|
|
|
|
reader.Close();
|
|
dataStream.Close();
|
|
response.Close();
|
|
return Content(responseFromServer);
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
[source,csharp]
|
|
----
|
|
using System.Linq;
|
|
using System.IO;
|
|
using System.Net;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
|
|
namespace WebApplicationDotNetCore.Controllers
|
|
{
|
|
public class RSPEC5144SSRFCompliantController : Controller
|
|
{
|
|
public IActionResult Index()
|
|
{
|
|
return View();
|
|
}
|
|
|
|
private readonly string[] whiteList = { "www.example.com", "example.com" };
|
|
|
|
public IActionResult ReadContentOfURL(string url)
|
|
{
|
|
// Extract the hostname from the URL
|
|
URI remoteUrl = new Uri(url);
|
|
string remoteHost = remoteUrl.Host;
|
|
|
|
// Match the incoming URL against a whitelist
|
|
if (!whiteList.Contains(remoteHost))
|
|
{
|
|
return BadRequest();
|
|
}
|
|
|
|
HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
|
|
|
|
HttpWebResponse response = (HttpWebResponse)request.GetResponse();
|
|
Stream dataStream = response.GetResponseStream();
|
|
StreamReader reader = new StreamReader(dataStream);
|
|
string responseFromServer = reader.ReadToEnd();
|
|
|
|
reader.Close();
|
|
dataStream.Close();
|
|
response.Close();
|
|
return Content(responseFromServer);
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
include::../highlighting.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|