Handling the flaw of a script script created by veracode

Question

We have an outdated web application in ASP.Net and C #, for which we get about 400 plus the lack of cross-site scripting scripts created by Veracode scan. I created an example web application and simulated a problem, and found that whenever we use any line input directly, it raises a flaw. Executing HttpUtility.HtmlEncode(TextBox1.Text);" satisfies the code, but applying this change in all 400 places is not possible, since then there will be a lot of work and testing effort. I am looking for something to implement some plugin in httphandler so that everyone the entrances got the encoding in one place and we don’t need to change it everywhere.Can someone please direct me if possible, if so, even if you can only guide me on the way, it would be enough to have at least direction. Thanks a lot in advance.

 StringOps strop = new StringOps(); string txt1, txt2; txt1 = HttpUtility.HtmlEncode(TextBox1.Text); txt2 = HttpUtility.HtmlEncode(TextBox2.Text); Response.Write(strop.Add(txt1, txt2)); 

If I delete the HttpUtility.HTMLEncode lines, Veracode complains about it. Since there are so many places where we perform these string operations, so implementing this everywhere is not possible. It would be possible for this encoding to be implemented in one place, and the entire response and request should go through this pipeline, for example. HTTPHandler and HTTPModule.

Answer 1

You can accomplish this with the Custom HttpModule , which conditionally assigns HttpResponse.Filter to intercept and handle HttpResponse.Write usage.

---

Module example

This example uses the Content-Type value for request.Header to determine whether to use html encoding.

 public class FilterResponseWriteModule : IHttpModule, IDisposable { private System.IO.Stream filterStream; public FilterResponseWriteModule() { } public void Init(HttpApplication context) { context.BeginRequest += Context_BeginRequest; } private void Context_BeginRequest(object sender, EventArgs e) { var context = (sender as HttpApplication).Context; if (ShouldApplyFilter(context.Request)) ApplyFilter(context.Response); } private bool ShouldApplyFilter(HttpRequest request) { return string.Equals(request.ContentType, @"text/plain", StringComparison.OrdinalIgnoreCase); } private void ApplyFilter(HttpResponse response) { filterStream = new EncodeStreamFilter(response.Filter); response.Filter = filterStream; } public void Dispose() { if (filterStream != null) { filterStream.Dispose(); } } } 

Stream Filter Example (Encapsulation and Override)

Stream is an abstract class, so it will generate all the corresponding stubs of the override method.

 public class EncodeStreamFilter : Stream, IDisposable { private Stream _baseStream; public EncodeStreamFilter(Stream responseFilter) { _baseStream = responseFilter; } public override void Write(byte[] buffer, int offset, int count) { byte[] bufferBlock = new byte[count]; Buffer.BlockCopy(buffer, offset, bufferBlock, 0, count); var encodedBytes = Encoding.UTF8.GetBytes(HttpUtility.HtmlEncode(Encoding.UTF8.GetString(bufferBlock))); _baseStream.Write(encodedBytes, 0, encodedBytes.Length); } public override bool CanRead { get { return _baseStream.CanRead; } } public override bool CanSeek { get { return _baseStream.CanSeek; } } public override bool CanWrite { get { return _baseStream.CanWrite; } } public override long Length { get { return _baseStream.Length; } } public override long Position { get { return _baseStream.Position; } set { _baseStream.Position = value; } } public override void Flush() { _baseStream.Flush(); } public override int Read(byte[] buffer, int offset, int count) { return _baseStream.Read(buffer, offset, count); } public override long Seek(long offset, SeekOrigin origin) { return _baseStream.Seek(offset, origin); } public override void SetLength(long value) { _baseStream.SetLength(value); } protected override void Dispose(bool disposing) { if (!disposing) { _baseStream.Dispose(); } base.Dispose(disposing); } } 

Add module to Web.Config

Note. In this case, I defined the module as a class in the App_Start folder of my application.

 <system.webServer> <modules> <add name="FilterResponseWriteModule" type="HttpModulesTestApp.App_Start.FilterResponseWriteModule"/> </modules> </system.webServer> 

Answer 2

Listen, I also have an outdated site in asp.net 1.0 or 2.0. We changed its scope to 4.0.

So my suggestion is that they change their structure and run the smoke test, and some problems may arise, after which they will be solved as expected, and then come to the main problem to handle things like Response.Write. Since ASP.net is now open source receiving this code and making minimal changes to the main functions and performing all your actions, try to use partial functionality or any thing like this as much as possible to get the update without losing your changes.