TASVS-CODE-4.4 - アプリケーションは XML パーサーを適切に制限し、可能な限り最も制限的な構成のみを使用すること、および、外部エンティティの解決などの安全でない機能を無効にし、XML eXternal Entity (XXE) 攻撃を防ぐことを検証します。
シッククライアントは XML パーサーが最も制限の厳しい構成を使用するように制限して、XML eXternal Entity (XXE) 攻撃を防ぐ必要があります。これにより、攻撃者が XML パーサーを悪用して機密データを読み取ったり、シッククライアントで任意のコードを実行することを防ぐのに役立ちます。
if (a > INT_MAX - b) {
// handle error
}
int c = a + b;
using System;
using System.IO;
using System.Runtime.Serialization.Formatters.Binary;
public class Program
{
public static void Main()
{
// Serialize an object
var obj = new MyClass();
var formatter = new BinaryFormatter();
var stream = new MemoryStream();
formatter.Serialize(stream, obj);
var serialized = stream.ToArray();
// Deserialize the object
var deserialized = (MyClass)formatter.Deserialize(new MemoryStream(serialized));
}
}
[Serializable]
public class MyClass
{
public string Name { get; set; }
}
using System;
using System.IO;
using System.Runtime.Serialization.Formatters.Binary;
using System.Security.Cryptography;
public class Program
{
public static void Main()
{
// Serialize an object
var obj = new MyClass();
var formatter = new BinaryFormatter();
var stream = new MemoryStream();
formatter.Serialize(stream, obj);
var serialized = stream.ToArray();
// Calculate a hash of the serialized object
var hash = CalculateHash(serialized);
// Deserialize the object
var deserialized = (MyClass)formatter.Deserialize(new MemoryStream(serialized));
// Verify the integrity of the deserialized object
if (!VerifyHash(serialized, hash))
{
// handle error
}
}
public static byte[] CalculateHash(byte[] data)
{
using (var sha256 = SHA256.Create())
{
return sha256.ComputeHash(data);
}
}
public static bool VerifyHash(byte[] data, byte[] hash)
{
using (var sha256 = SHA256.Create())
{
var computedHash = sha256.ComputeHash(data);
return StructuralComparisons.StructuralEqualityComparer.Equals(computedHash, hash);
}
}
}
[Serializable]
public class MyClass
{
public string Name { get; set; }
}
using System;
using System.IO;
using System.Runtime.Serialization.Json;
public class Program
{
public static void Main()
{
// Deserialize JSON data
var json = "{\"Name\":\"Alice\"}";
var serializer = new DataContractJsonSerializer(typeof(MyClass));
var stream = new MemoryStream(System.Text.Encoding.UTF8.GetBytes(json));
var deserialized = (MyClass)serializer.ReadObject(stream);
}
}
[DataContract]
public class MyClass
{
[DataMember]
public string Name { get; set; }
}
using System;
using System.Diagnostics;
public class Program
{
public static void Main()
{
// Spawn a process with user-controlled arguments
var process = new Process();
process.StartInfo.FileName = "cmd.exe";
process.StartInfo.Arguments = "/c " + user_input;
process.Start();
}
}
using System;
using System.Diagnostics;
public class Program
{
public static void Main()
{
// Validate and sanitize process arguments
if (!IsValid(user_input))
{
// handle error
}
// Spawn a process with validated and sanitized arguments
var process = new Process();
process.StartInfo.FileName = "cmd.exe";
process.StartInfo.Arguments = "/c " + user_input;
process.Start();
}
public static bool IsValid(string input)
{
// Validate and sanitize input
// For example, check for allowed characters and length
allowed = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
if (input.Length > 10 || input.Any(c => !allowed.Contains(c)))
{
return false;
}
return true;
}
}
using System;
using System.IO;
public class Program
{
public static void Main()
{
// Use user-submitted filename to access a file
var filename = user_input;
var path = Path.Combine("C:\\files", filename);
var contents = File.ReadAllText(path);
}
}
using System;
using System.IO;
public class Program
{
public static void Main()
{
// Validate and sanitize user-submitted filename
if (!IsValid(user_input))
{
// handle error
}
// Use validated and sanitized filename to access a file
var filename = user_input;
var path = Path.Combine("C:\\files", filename);
var contents = File.ReadAllText(path);
}
public static bool IsValid(string input)
{
// Validate and sanitize input
// For example, check for deny listed characters and defined list of allowed directories
good-directories = new string[] {"C:\\files", "D:\\data"};
deny-list = new string[] {"..", "/", "\\"};
if (input.Any(c => deny-list.Contains(c)) || !good-directories.Contains(Path.GetDirectoryName(input)))
{
return false;
}
return true;
}
}
using System;
using ThirdPartyLibrary;
public class Program
{
public static void Main()
{
// Sandbox the third-party library
using (var sandbox = new Sandbox())
{
// Use the third-party library in the sandbox
sandbox.DoSomething();
}
}
}