ASP.NET

Re: Cross site scripting poor validation for asp.net labels

13-Aug-17 23:49

Sounds like a bug in Fortify.

If you're using .NET 4.5 or higher, you could try the newer binding syntax:

<asp:Label ID="lblCsf" runat="server" Text='<%#: Eval("Max") %>'/>

The : after the %# tells ASP.NET to HTML-encode the text for you.
What's New in ASP.NET 4.5 and Visual Studio 2012 | HTML Encoded Data-Binding Expressions[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Member 1335715616-Aug-17 6:05

Member 13357156

16-Aug-17 6:05

Thanks for your response, but initially it was : and since fortify was showing as cross site vulnerability so I have changed to use AntiXss. But still it shows the same vulnerability. The only difference was while using : , it says Cross site vulnerability and when using AntiXss, it says Poor cross site vulnerability.

Re: Cross site scripting poor validation for asp.net labels

Richard Deeming16-Aug-17 10:11

Re: Cross site scripting poor validation for asp.net labels

16-Aug-17 10:11

Still sounds like a bug in Fortify to me.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

viprat18-May-20 23:10

viprat

18-May-20 23:10

Hi,

I am facing same issue.
Did you find any solution for this?

Thanks

Maintaining sessions in Web Applications with Web Api

indian14310-Aug-17 8:32

Re: Maintaining sessions in Web Applications with Web Api

10-Aug-17 8:32

Hi,

I am creating a ASP.Net, Web Api web application which I am planning to use mostly the Web Api for the Business and Data Access calls, trying to avoid the MVC Controllers, as I am mostly using Web Api calls and Web Api doesn't support Sessions, what I am trying to do is to keep/pass Session values as hidden fields in html pages. And in every call those values will be passed to the Web Api methods and back to the UI to be stored in the Hidden fields.

My question is, is this a good approach or very bad approach, if its bad approach can you please guide me what are the alternative good approaches. I am not familiar much with the ASP.Net MVC, I was very good in WebFarms sometime back, trying my best to come out of that old thinking bros, need some help.

Thanks in advance.

Thanks,

Abdul Aleem

"There is already enough hatred in the world lets spread love, compassion and affection."

F-ES Sitecore10-Aug-17 22:14

Website down frequently in windows server 2008 standard IIS 7

10-Aug-17 22:14

Have you tried these

Accessing Session Using ASP.NET Web API - Stack Overflow[^]

Providing session state in ASP.NET WebAPI[^]

ramesh1080@yahoo.co.in9-Aug-17 19:28

ramesh1080@yahoo.co.in

9-Aug-17 19:28

Hi Friends,

we are facing issue in website goes down in frequently, starting to working on after recycling app pool.

Configuration and technology:

windows server 2008 standard IIS 7
Website developed in asp.net 1.1

please provide resolution if you guys knowing or experienced the same.

Advance wishes!!!

Re: Website down frequently in windows server 2008 standard IIS 7

Nathan Minier11-Aug-17 1:37

Nathan Minier

11-Aug-17 1:37

The application code running that particular site is throwing an un-handled exception and is locking up the process until it is reset (recycled). Check the event viewer, you will likely find some .NET errors lodged in there.

"There are three kinds of lies: lies, damned lies and statistics."
- Benjamin Disraeli

Trying to create modal dialog using jQuery

indian1439-Aug-17 6:50

9-Aug-17 6:50

Hi,

I am trying to create modal dialog which contains Text-boxes and drop-downs which are going to get the Data from the parent page, but its not creating the modal dialog but its putting the values on the same parent page. Here is how I have created the modal

$('#btnViewJob').click(function (event) {
   var mytext = 'My first modal dialog using MVC: <input type="text" value="Some value comes from parent page" id="temp"' + somevaluecomesfromparentpage + '" />'; 

    $('<div id="dialog"><table><tr><td>' + mytext + '</td></tr></table></div>').appendTo('body');
    event.preventDefault();

    $('#dialog').dialog({
autoOpen: false,
width: 400,
resizable: false,
title: "hi there",
modal: true,
buttons: {
    "Close": function () {
$(this).dialog("close");
    }
}
    });
});

Thanks,

Abdul Aleem

"There is already enough hatred in the world lets spread love, compassion and affection."

Richard Deeming9-Aug-17 8:28

9-Aug-17 8:28

You've specified autoOpen:false, so the first time you click the button, the dialog is created but never shown.

The next time you click the button, you create a new <div> with the same ID, and append it to the body. IDs are supposed to be unique, so the #dialog selector only returns the first element with that ID. Since the dialog(...) call is what hides the element, the subsequent elements are never hidden, and appear at the end of the body.

You need to change the code so that it uses the existing element on subsequent clicks:

JavaScript

$('#btnViewJob').click(function(event) {
    event.preventDefault();
    
    var mytext = 'My first modal dialog using MVC: <input type="text" value="Some value comes from parent page" id="temp"' + somevaluecomesfromparentpage + '" />';
    
    var dialog = $("#dialog");
    if (!dialog.length) {
        // First time: create the dialog element:
        dialog = $("<div/>").attr("id", "dialog").appendTo("body");
        
        dialog.dialog({
            autoOpen: false,
            width: 400,
            resizable: false,
            title: "hi there",
            modal: true,
            buttons: {
                "Close": function() {
                    $(this).dialog("close");
                }
            }
        });
    }
    
    dialog.empty().html("<table><tr><td>" + mytext + "</td></tr></table>");
    dialog.dialog("open");
});

Demo[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

indian1439-Aug-17 9:39

9-Aug-17 9:39

But for my its is saying Uncaught TypeError: dialog.dialog is not a function, anything can I do to avoid this buddy?

Thanks,

Abdul Aleem

"There is already enough hatred in the world lets spread love, compassion and affection."

Richard Deeming9-Aug-17 9:46

9-Aug-17 9:46

Have you included the jQuery UI scripts?

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

indian1439-Aug-17 9:59

9-Aug-17 9:59

In registerbundles I have written this:

bundles.Add(new StyleBundle("~/Content/themes/bsc/css").Include(
                          "~/Content/themes/bsc/jquery-ui.min.css",
                          "~/Content/themes/bsc/jquery-ui.structure.min.css",
                          "~/Content/themes/bsc/jquery-ui.theme.min.css"));

And in the cshtml, I have written like below:

@section head{
    @Styles.Render("~/Content/css")
    @Styles.Render("~/bundles/bootstrap")
    @Styles.Render("~/bundles/jquery")
    @Styles.Render("~/bundles/jqueryval")    
    @Scripts.Render("~/bundles/jqueryui")
    @Scripts.Render("~/Content/themes/bsc/css")    
}

And in the .js file I have written as below:

        $('#btnViewJob').click(function (event) {
            event.preventDefault();

            var mytext = 'My first modal dialog using MVC: <input type="text" value="Some value comes from parent page" id="temp" />';

            var dialog = $("#dialog");
            if (!dialog.length) {<br />
                dialog = $("<div/>").attr("id", "dialog").appendTo("body");

                dialog.dialog({
                    autoOpen: false,
                    width: 400,
                    resizable: false,
                    title: "hi there",
                    modal: true,
                    buttons: {
                        "Close": function () {
                            $(this).dialog("close");
                        }
                    }
                });
            }

            dialog.empty().html("<table><tr><td>" + mytext + "</td></tr></table>");
            dialog.dialog("open");
        });

In the css I have written like below:

table#tableDisplay2 {
    border-collapse: collapse;<br />
}
<h1>tableDisplay2 th {</h1>

<pre>
background-color: #eee;
border-top: 1px solid #fff;

}

tableDisplay2 tr:hover {

background-color: #ccc;

}

tableDisplay2 tr::selection {

background-color: #ccc;

}

tableDisplay2 tr.selected { background-color:#ccc !important; }

tableDisplay2 td:hover {

cursor: pointer;
}

CSS part is working fine it is changing the color of the table row when selected, but only thing is when button clicked, its not opening the new modal dialog, and giving the same error that is: Uncaught TypeError: dialog.dialog is not a function. Any help my friend?

Thanks,

Abdul Aleem

"There is already enough hatred in the world lets spread love, compassion and affection."

Richard Deeming9-Aug-17 10:10

9-Aug-17 10:10

What about the style bundle for "~/bundles/jqueryui"?

Also, view the source of the page to make sure the jQuery UI scripts are included, and click on the link to make sure they're loading properly.

And are you using the full jQuery UI library, or a custom download? It's possible that you've got a version that doesn't include the dialog widget.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

indian1439-Aug-17 11:44

9-Aug-17 11:44

Yes I have that in my register bundles method:

            bundles.Add(new ScriptBundle("~/bundles/jqueryui").Include(
                        "~/Scripts/jquery-ui-{version}.js"));

I saw the ViewSource only thing is, jquery-ui is loading two times, can it be a problem, here is how it looking in the header section of the page:

<script src="/BSCSecurityAddressBookWeb/Scripts/jquery-ui-1.11.4.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/jquery-ui-1.12.1.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/jquery-ui-1.12.1.js"></script>
<script src="/BSCSecurityAddressBookWeb/Content/themes/bsc/jquery-ui.min.css"></script>
<script src="/BSCSecurityAddressBookWeb/Content/themes/bsc/jquery-ui.structure.min.css"></script>
<script src="/BSCSecurityAddressBookWeb/Content/themes/bsc/jquery-ui.theme.min.css"></script>

My Register Bundle Config method is as below, is there any possibility I am missing anything in it?:

        public static void RegisterBundles(BundleCollection bundles)
        {
            bundles.Add(new ScriptBundle("~/bundles/jquery").Include(
                        "~/Scripts/jquery-{version}.js"));

            bundles.Add(new ScriptBundle("~/bundles/jqueryval").Include(
                        "~/Scripts/jquery.validate*"));

            bundles.Add(new ScriptBundle("~/bundles/modernizr").Include(
                        "~/Scripts/modernizr-*"));

            bundles.Add(new ScriptBundle("~/bundles/bootstrap").Include(
                      "~/Scripts/bootstrap.js",
                      "~/Scripts/respond.js"));

            bundles.Add(new ScriptBundle("~/bundles/layout").Include(
        "~/Scripts/Shared/Layout.js"));

            bundles.Add(new ScriptBundle("~/bundles/jqueryui").Include(
                        "~/Scripts/jquery-ui-{version}.js"));

            bundles.Add(new ScriptBundle("~/bundles/employee").Include(
                    "~/Scripts/Employee/Index.js",
                    "~/Scripts/Employee/Employee.js"));

            bundles.Add(new ScriptBundle("~/bundles/multijobchange").Include(
        "~/Scripts/MultiJobChange/Index.js",
        "~/Scripts/MultiJobChange/MultiJobChange.js"));           

            bundles.Add(new StyleBundle("~/Content/css").Include(
                      "~/Content/bootstrap.css",
                      "~/Content/site.css",
                      "~/Content/AppCss.css",
                      "~/Content/css/CustomStyles.css"
                      )
                      );

            bundles.Add(new StyleBundle("~/Content/themes/bsc/css").Include(
                          "~/Content/themes/bsc/jquery-ui.min.css",
                          "~/Content/themes/bsc/jquery-ui.structure.min.css",
                          "~/Content/themes/bsc/jquery-ui.theme.min.css"));
        }

still its giving me the same error what else could it be buddy?

Thanks,

Abdul Aleem

"There is already enough hatred in the world lets spread love, compassion and affection."

-- modified 9-Aug-17 18:17pm.

F-ES Sitecore9-Aug-17 23:11

9-Aug-17 23:11

It's included three times (two different versions) and yes that's a problem, you need to make sure only one version is referenced. Make sure you don't have copies of multiple versions in your scripts folder then try and work out where other duplicate references are coming from.

indian14310-Aug-17 13:03

10-Aug-17 13:03

I have removed all the duplication, here is how View Source of my page looks like, still I am getting the same error buddy, I am also not understanding what mistake did I do?

<link href="/BSCSecurityAddressBookWeb/Content/bootstrap.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/site.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/AppCss.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/css/CustomStyles.css" rel="stylesheet"/>
<script src="/BSCSecurityAddressBookWeb/Scripts/jquery-1.12.4.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/jquery-2.1.4.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/jquery-ui-1.12.1.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/Shared/Layout.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/Employee/Index.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/Employee/Employee.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/MultiJobChange/Index.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/MultiJobChange/MultiJobChange.js"></script>    
<link href="/BSCSecurityAddressBookWeb/Content/bootstrap.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/site.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/AppCss.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/css/CustomStyles.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Scripts/bootstrap.js" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Scripts/respond.js" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Scripts/jquery-1.12.4.js" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Scripts/jquery-2.1.4.js" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Scripts/jquery.validate.js" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Scripts/jquery.validate.unobtrusive.js" rel="stylesheet"/>
<script src="/BSCSecurityAddressBookWeb/Content/themes/bsc/jquery-ui.min.css"></script>
<script src="/BSCSecurityAddressBookWeb/Content/themes/bsc/jquery-ui.structure.min.css"></script>
<script src="/BSCSecurityAddressBookWeb/Content/themes/bsc/jquery-ui.theme.min.css"></script>

These are the only scripts that are referenced in my page when I did View Source of my Page.

Thanks,

Abdul Aleem

"There is already enough hatred in the world lets spread love, compassion and affection."

-- modified 10-Aug-17 19:51pm.

F-ES Sitecore10-Aug-17 22:09

10-Aug-17 22:09

You still have two versions of jQuery and you're also linking to your js scripts as stylesheets?

indian14311-Aug-17 13:13

11-Aug-17 13:13

Hi,

I have fixed all of those files and duplication, it looks like below in View Source of my page, still the error is happening, can you please help me little bit buddy? Am I still doing mistakes my friend?

<link href="/BSCSecurityAddressBookWeb/Content/bootstrap.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/site.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/AppCss.css" rel="stylesheet"/>
<link href="/BSCSecurityAddressBookWeb/Content/css/CustomStyles.css" rel="stylesheet"/>

<script src="/BSCSecurityAddressBookWeb/Scripts/jquery-2.1.4.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/jquery-ui-1.12.1.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/jquery.validate.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/jquery.validate.unobtrusive.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/Shared/Layout.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/Employee/Index.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/Employee/Employee.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/MultiJobChange/Index.js"></script>
<script src="/BSCSecurityAddressBookWeb/Scripts/MultiJobChange/MultiJobChange.js"></script>

Thanks,

Abdul Aleem

"There is already enough hatred in the world lets spread love, compassion and affection."

F-ES Sitecore13-Aug-17 22:18

Procedure or function 'sp_getchech' expects parameter '@ID', which was not supplied

13-Aug-17 22:18

What I normally do with these issues is try and strip everything right back to identify the issue. So create a new html page with just the jQuery and jQuery UI script references, and just the elements and script involved in the dialog and see if it works. If it does the issue is something somewhere else interfering with the js so you can keep eliminating things from your actual page until the dialog works and the last thing you removed was probably the cause. However if the basic version still doesn't work the issue is more likely your code or includes.

samflex9-Aug-17 5:24

samflex

9-Aug-17 5:24

This is supposed to be simple.

I have a very simple stored proc which selects records based on ID provided by user.

ALTER PROCEDURE [dbo].[sp_getcheck]
@ID int
AS
BEGIN
-- SET NOCOUNT ON added to prevent extra result sets from
-- interfering with SELECT statements.

SET NOCOUNT ON;
If NOT EXISTS(select * from mytable where ID=@ID)
  BEGIN
	RAISERROR (
    'ID number entered %d is invalid',
    11,
    1,
    @ID);
  END
END

What we would like to do is have user enter an ID and check to see if it exists on our database.

If yes, user is redirected to a page of his/her choice.

If no, we would like to keep user on same screen with a message that ID number entered Q1254 is invalid.

That error is raised on the stored procedure and we would like C# code to display that message on the screen for the user.

Here is that code:

protected void chk_Click(object sender, EventArgs e)
{

    if (!string.IsNullOrEmpty(checknumber.Text))
    {
        SqlConnection Conn = default(SqlConnection);

        //Read in connection String
        Conn = new SqlConnection(ConfigurationManager.ConnectionStrings["Constr"].ConnectionString);
        Conn.Open();

        SqlCommand cmd = new SqlCommand("sp_getcheck", Conn);
        //Retrieve the value of the output parameter

        //Add the output parameter to the command object
        cmd.Parameters.AddWithValue("@ID", checknumber.Text);
        SqlParameter outPutParameter = new SqlParameter();
        SqlDataReader dr = cmd.ExecuteReader();

        //Retrieve the value of the output parameter

        if (dr.Read())
        {
            try
            {
                //we add a hidden field called IsValid to the markup and set the IsValid value in the event handler here.
                imgstatus.ImageUrl = "images/Icon_Available.gif";
                lblStatus.ForeColor = Color.Green;

                //redirect based on value of hidden form field called evalue
                var evalue = hequipID.Value;
                if (evalue == "1")
                {
                    Response.Redirect("Air.aspx?pageId=1");
                }
                if (evalue == "2")
                {
                    Response.Redirect("Land.aspx?pageId=2");
                }

                //ID exists, get form fields and store db values in them:
                //txtfname.Text = (dr["FullName"].ToString());

            }
            catch (SqlException ex)
            {
                //Something is wrong with this taxpayer's account.
                imgstatus.ImageUrl = "images/NotAvailable.jpg";
                lblStatus.ForeColor = Color.Red;
                lblStatus.Text = ex.Message;
                chk.BackColor = Color.Silver;
                System.Threading.Thread.Sleep(2000);
            }
        }
    }
  }

en I tried to run the code, I get the following error message:

Procedure or function 'sp_getchech' expects parameter '@ID', which was not supplied

Surely I am doing something wrong.

Any ideas how to resolve this?

Thanks in advance

modified 9-Aug-17 11:47am.

Re: Procedure or function 'sp_getchech' expects parameter '@ID', which was not supplied

Richard Deeming9-Aug-17 8:14