Re: Pen-tester's analysis of .NET security?

From: Frank Knobbe (frank_at_knobbe.us)
Date: 03/25/04

  • Next message: Duy Trac: "RE: Oracle DB Audity" 
    To: jeff@jeffbryner.com
Date: Wed, 24 Mar 2004 18:28:03 -0600

    On Wed, 2004-03-24 at 17:59, Jeff Bryner wrote:
    > ADODB doesn't but .net 1.1 does filter for CSS input. Code up a basic
    > page and enter <scrip in a text box and you'll trigger a
    > HttpRequestValidationException

    I see. So it checks at request time when you use HttpRequest. (Sorry, I
    had my mind on the database facing side :)

    But isn't that all it does? I mean, you are still left with converting
    the content of the caught string yourself, using HTMLEncode or similar.
    In other words, all it does is detect that dangerous characters are
    present. It doesn't protect you by converting them.

    Which means you are still left to do the conversion (and space trimming,
    and cutting to maxlength....) yourself...

    Regards,
    Frank

  • Next message: Duy Trac: "RE: Oracle DB Audity"