|
Assuming Rule SRG-APP-000225 from the Application Security and Development Security Technical Implementation Guide (which is really an SRG, silly cybersec people), the current version dated 27APR2018 has a lot of example detail in it. https://iasecontent.disa.mil/stigs/zip/U_ASD_V4R6_STIG.zip
The general idea is that it should not be left "half-open" on failure, so something like a no-op sled cannot push an instruction into the application and bypass authentication. If you are running a basic CRUD app, then IIS will handle this stuff for you, providing you dispose of database connections which you're supposed to do anyway if you're using EF in the Repository/Unit of Work pattern.
By and large, in an MVC.NET application all you can really do is make sure that any operational statics are cleared (or reset as part of an application restart/correction process) and that un-managed resources are properly disposed as part of the failure. You can wrap all of this into a failure handler that can attempt to self-correct and, failing that, fail closed.
This all said, if an auditor declared it a finding then they should have given you some sort of finding detail.
If you need detailed support or code review, I'm in the GAL.
"There are three kinds of lies: lies, damned lies and statistics."
- Benjamin Disraeli
|
|
|
|
|
Hello,
Anyone knows how to create a text file in client machine using asp.net code behind ??
Please suggest me any solution...
Thanks in advance...
|
|
|
|
|
Your code-behind runs on the server. It has no access to the client's file system.
The only way you can "create" a file on the client's computer is to write it to the response with the appropriate headers. The user will then be able to save the file wherever they want. They will also be able to choose not to save the file.
And to pre-empt your next question: no, you can't force them to save the file, and you can't influence where the file is saved. You can provide a default file name, but it's only a suggestion, and the user is free to change it.
Response.ContentType = "text/plain";
Response.AppendHeader("Content-Disposition", "attachment;filename=TheSuggestedFileName.txt");
string sourcePath = Server.MapPath("~/path/to/the/file.txt");
Response.TransmitFile(sourcePath);
Response.End();
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
I working on an ASP .NET project and am have serious problems with TFS source control mapping. First what was happening is that because nuget or no other dll third party folder was setup when the project was downloaded to a new work space all the dll's were missing. We'll to solve this problem I did created a shared source control folder and moved all of the needed third party dll's to this source control folder and had each project reference them from there. Now, this is the problem I'm left with. It seems that there are certain files and folders of various type (i.e. print.txt, showChart.pdf) that are in project folders which are missing after the project has been fixed on one machine's workspace, checked-in, and get latest to another machine's workspace. They disappear after the source code is downloaded to a new mapping on a different machine. It seems that these folders and files will only stay in the workspace's mapping that they were fixed in. Does anyone have any suggestions?
modified 28-May-18 9:20am.
|
|
|
|
|
I spent an hour today looking at the Miniblog project and was quite impressed. I had no idea that you can do some of the things he did with MVC. What he did with robots.txt and the sitemap seems pretty cool and the rewrite section in web.config was an eye opener for me.
So this Segways into a couple of questions for me.
I see how he created views with almost a single file, but how did he do this without a controller?
I ask this because I think MVC really needs a CMS package so it can be more like Wordpress, in which website owners can create new pages. I can write a view, but I can't figure out how to handle the controller part.
I can't compete with Wordpress, and these Wordpress guys that are very low skilled, who just copy and paste code and html are really grabbing a large chuck of market share.
If my little Project Indigo Personal edition had CMS features It would be a game changer for me.
If it ain't broke don't fix it
|
|
|
|
|
Good day friends! Please I need help in this issue.
I have a database made up of
<br />
Name Section Day of Duty<br />
John U. Fishery Monday<br />
Andrew S. HR Tuesday<br />
Chow C. Mgr Monday<br />
Bian H. Coord. Tuesday<br /><br />
Hui Zhao APC Wednesday<br />
My request is that; if I retrieved the records from database, they should be grouped by Day of Duty and display in this format:
<br />
Name Section Day of Duty<br />
John U. HR Monday<br />
Chow C. Mgr Monday<br />
Andrew S. HR Tuesday<br />
Bian H. Coord. Tuesday<br /><br />
Hui Zhao APC Wednesday<br />
I tried using Group By SQL statement but to didn't work and I don't know the right keywords to use while searching on google though I have tried.
Please can this be achieved?
Help please!
Am using ASP.Net (VB.Net)
|
|
|
|
|
|
This is also possible with the linq by using the same order by query.
|
|
|
|
|
You should tell OP, not me.
|
|
|
|
|
This is a product of poor design and improper use of TFS but I have started on a new project with big problems. A little background first. This is an ASP .NET MVC 3 EntityFramework multiple project application. Now, when development first began several years ago the application had a production branch of TFS source control and no other branches. Two programmers started and worked on creating this application. Now, as each did work they would download directly from the production branch and check-in directly into the production branch. This went on until two weeks before I started work on the application.
Three weeks ago a three separate named user branch tree, named for each developer, was created off of the production branch for each new developer to work on so now checkout/check-in is no longer directly off of the production branch. What we have is a main production branch as the root and three sub branches right off of the production branch. What a mess!
Now to the problem we are currently having. When they downloaded source control application code from the production branch to each person's named branch all of the asp project and third party dll's are gone along with the bin and bin/debug directories. Each of the new branches won't build their projects and the main Web project won't build. What I have done is pulled all of the asp project and third party dll's into my branch from production created a working branch. Than I checked my branch back into MY named branch of source control. Now, after doing this another developer has downloaded the new updated, MY named branch, branch to their machine and again the bin and bin\debug directories and all of the dll's are missing. Based on my confusing description of the problem can someone provide guidance on how we can fix this problem?
modified 24-May-18 20:55pm.
|
|
|
|
|
Not sure I fully understand the issue and it depends what these third party dlls are, but you usually solve this problem with nuget packages. So if your project needs, for example, Entity Framework, you add that to your project as a nuget package. What that does is create a folder under a "packages" folder and that folder contains xml that describes the package. When you check the code in you also check in the packages folder. When the next developer gets the project they will have the packages but not the dlls, however when they compile VS will realise this and use the data in the nuget package to download the dlls itself. So rather than manage third party dlls you manage nuget packages and VS sorts it out for you.
|
|
|
|
|
One problem with nuget is the application is on an intranet. What I have done is to create a root level folder and checked it in. With the new folder I have added all of the needed third party dll's and referenced them in each of the application project's references. Is this the correct way to do it or is nuget still possible?
|
|
|
|
|
You can host your own nuget server and even make your own nuget packages, so yes it's possible. It'll take some learning and trial and error, but I know it's possible.
|
|
|
|
|
I was considering adding a blog to my website to get more traffic or a pay wall of knowledge and was wondering if anybody has implemented any good packages for this. I really don't want to write a app for that at the moment plus I'n not really set on a design for it.
If I did write a blog app for myself, I would want to have unique page names, but I can't figure out how to dynamically add pages to a controller.
I can add views easy, but the controller part is fuzzy for me. Guess I would have to use 1 page name and add a route as the description.
Any thoughts?
If it ain't broke don't fix it
|
|
|
|
|
|
I remember the original one, it was pretty cool.
I take a look at this today, Thanks!
I did look around but didn't see much, strange I didn't find this one.
If it ain't broke don't fix it
|
|
|
|
|
I like to know what is
refresh token and its usages.
we can get our job done by access token then why should i go for
refresh token ....what would be the benefit.
i saw a example of refresh token which show when we are getting access token then refresh token also passing along with access token. so i was totally confuse and do not understand how and why refresh token.
if possible please discuss the story of refresh token. thanks in advance.
|
|
|
|
|
When a page is requested that requires a token for authentication, that is the first token.
But if the user refreshes the page, then perhaps the first token is now expired or no longer valid, so a new token is issued called a refresh token.
Most likely this is a form, so on Post, validation must be correct first then the token must match to submit the form, or to call the function after token matching.
If your tokens never match, then the form will never get written.
If you keep issuing the same token, then token authentication will become useless and bots will take over the form.
In MVC it's called the AntiForgeryToken and you call it using attributes in the MVC controller.
So on a GET request you issue the token from the controller and it gets written inside the form tags in the view if you place the correct HTML helper in the right spot.
Then the page gets submitted, a POST request and the controller will check the token if you place the right code to check for the token first before or after validation or Model.IsValid.
If it ain't broke don't fix it
|
|
|
|
|
sorry not a good answer. my other points are not considered.
|
|
|
|
|
Interesting, I thought it was a pretty clear description of the process and the reasons for that process.
Never underestimate the power of human stupidity
RAH
|
|
|
|
|
The question was confusing, but I thought my reply was OK without being long winded on the subject.
I didn't have time to draw diagrams or write an article on the subject.
Maybe English was not his first language.
That's for backing me up on that.
If it ain't broke don't fix it
|
|
|
|
|
|
Hi,
I am maintaining a new ASP.Net application, which was running fine when I was using database; xxxxx, but another copy of the same Database when I started using: xxxx_20180425 then it started giving me the below error, its a Production application when I took the backup and restore, it started giving me the error as below, I am just confused is it Problem really in the application or just some issues related to new Database permissions for the user. Any help would be greatly helpful.
And can you please help me if I can copy the same roles of user123 permissions on the xxxxx database to xxxx_20180425, so that the user will have the same permissions. Any help would be greatly helpful. Thanks in advance.
Here is the error message:
A potentially dangerous Request.QueryString value was detected from the client (msg="...ema 'dbo'.<br />The EXECUTE pe...").
Description: ASP.NET has detected data in the request that is potentially dangerous because it might include HTML markup or script. The data might represent an attempt to compromise the security of your application, such as a cross-site scripting attack. If this type of input is appropriate in your application, you can include code in a web page to explicitly allow it. For more information, see <a href="http://go.microsoft.com/fwlink/?LinkID=212874">http://go.microsoft.com/fwlink/?LinkID=212874</a>.
Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.QueryString value was detected from the client (msg="...ema 'dbo'.<br />The EXECUTE pe...").
Source Error:
The source code that generated this unhandled exception can only be shown when compiled in debug mode. To enable this, please follow one of the below steps, then request the URL:
<ol>
<li>Add a "Debug=true" directive at the top of the file that generated the error. Example:</li>
</ol>
H615311168H
or:
2) Add the following section to the configuration file of your application:
<configuration>
<system.web>
<compilation debug="true"/>
</system.web>
</configuration>
Note that this second technique will cause all files within a given application to be compiled in debug mode. The first technique will cause only that particular file to be compiled in debug mode.
Important: Running applications in debug mode does incur a memory/performance overhead. You should make sure that an application has debugging disabled before deploying into production scenario.
Stack Trace:
[HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (msg="...ema 'dbo'.<br />The EXECUTE pe...").]
System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) +9721353
System.Web.HttpRequest.ValidateHttpValueCollection(HttpValueCollection collection, RequestValidationSource requestCollection) +184
System.Web.HttpRequest.get_QueryString() +55
System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull) +70
System.Web.UI.Page.DeterminePostBackMode() +69
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6704
System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +245
System.Web.UI.Page.ProcessRequest() +72
System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +21
System.Web.UI.Page.ProcessRequest(HttpContext context) +58
ASP.error_aspx.ProcessRequest(HttpContext context) +37
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +341
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +69
Thanks,
Abdul Aleem
"There is already enough hatred in the world lets spread love, compassion and affection."
|
|
|
|
|
You need to examine the actual data to see whether it is a definite threat or not. It may be just that ASP.NET has seen a set of tokens which suggest something.
|
|
|
|
|
The exception message is quite clear. It is not related to permissions but there was a SQL query that contains potential dangerous (HTML) content.
Unfortunately only a portion of the query string is included with the message:
"...ema 'dbo'.<br />The EXECUTE pe..." But that does not look like a SQL query (besides a query contains such text which seems to be rather unlikely).
I suggest to debug your code to find out which code portion generates the query containing the above string and check that. For me it looks like the wrong string is passed as query (e.g. wrong variable name used or re-using a variable but forgetting to assign the new value).
A hint might be that the string portion seems to be part of an error message like "The EXECUTE permission was denied on the object ..." which is passed as SQL query. If so, fix the code that is using an error message as SQL query string first (e.g. by reporting the error instead) and then try to solve the permission error.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
