ASP.NET

Abhipal Singh wrote:

If !string.IsNullOrEmpty(...

• Passwords are stored as plain text:
  You should only ever store a salted hash of the password.
  Secure Password Authentication Explained Simply[^]
  Salted Password Hashing - Doing it Right[^]
• Connecting to the database as "sa":
  This will give an attacker complete control over your SQL instance, and potentially the server as well.
  You should only ever connect using a specific account which has the least permissions required to run your application.
• Disposable objects not in "using" blocks:
  In the event of an exception, the SqlConnection and SqlCommand objects might not be cleaned up properly.
  All objects which implement IDisposable (and don't escape the current method) should be wrapped in a using block.

• Passwords are stored as plain text:
  You should only ever store a salted hash of the password.
  Secure Password Authentication Explained Simply[^]
  Salted Password Hashing - Doing it Right[^]
• Disposable objects not in "using" blocks:
  In the event of an exception, the SqlConnection and SqlCommand objects might not be cleaned up properly.
  All objects which implement IDisposable (and don't escape the current method) should be wrapped in a using block.

int bytesRead = csEncrypt.Read(fromEncrypt, 0, fromEncrypt.Length);
return textConverter.GetString(fromEncrypt, 0, bytesRead);

public String DecryptMessage(byte[] encrypted)
{
    using (var aes = new AesManaged())
    using (var decryptor = aes.CreateDecryptor(key, IV))
    using (var ms = new MemoryStream(encrypted))
    using (var cs = new CryptoStream(ms, decryptor, CryptoStreamMode.Read))
    {
        byte[] decrypted = new byte[encrypted.Length];
        int bytesRead = cs.Read(decrypted, 0, decrypted.Length);
        return Encoding.ASCII.GetString(decrypted, 0, bytesRead);
    }
}

public byte[] DecryptMessage(byte[] encrypted)
{
    using (var aes = new AesManaged())
    using (var decryptor = aes.CreateDecryptor(key, IV))
    using (var ms = new MemoryStream(encrypted))
    using (var cs = new CryptoStream(ms, decryptor, CryptoStreamMode.Read))
    {
        byte[] decrypted = new byte[encrypted.Length];
        int bytesRead = cs.Read(decrypted, 0, decrypted.Length);
        
        if (bytesRead != decrypted.Length)
        {
            Array.Resize(ref decrypted, bytesRead);
        }

        return decrypted;
    }
}