Uploaded image for project: 'Rules Repository'
  1. Rules Repository
  2. RSPEC-3884

"CoSetProxyBlanket" and "CoInitializeSecurity" should not be used

    Details

    • Type: Vulnerability Detection
    • Status: Active
    • Resolution: Unresolved
    • Labels:
    • Message:
      Remove this call to "xxx"; it's useless in this context.
    • Highlighting:
      Hide

      CoSetProxyBlanket|CoInitializeSecurity

      Show
      CoSetProxyBlanket|CoInitializeSecurity
    • Default Severity:
      Blocker
    • Impact:
      High
    • Likelihood:
      High
    • Default Quality Profiles:
      Sonar way
    • Targeted languages:
      VB.Net
    • Covered Languages:
      C#
    • Irrelevant for Languages:
      ABAP, C, C++, Cobol, CSS, Flex, HTML, Java, JavaScript, Objective-C, PHP, PL/I, PL/SQL, Python, RPG, Swift, VB6, XML
    • Remediation Function:
      Constant/Issue
    • Constant Cost:
      20min
    • Analysis Scope:
      Main Sources, Test Sources
    • OWASP:
      A6
    • FxCop:
      AvoidCallingProblematicMethods, CA2001

      Description

      CoSetProxyBlanket and CoInitializeSecurity both work to set the permissions context in which the process invoked immediately after is executed. Calling them from within that process is useless because it's too late at that point; the permissions context has already been set.

      Specifically, these methods are meant to be called from non-managed code such as a C++ wrapper that then invokes the managed, i.e. C# or VB.NET, code.

      Noncompliant Code Example

      [DllImport("ole32.dll")]
      static extern int CoSetProxyBlanket([MarshalAs(UnmanagedType.IUnknown)]object pProxy, uint dwAuthnSvc, uint dwAuthzSvc,
      	[MarshalAs(UnmanagedType.LPWStr)] string pServerPrincName, uint dwAuthnLevel, uint dwImpLevel, IntPtr pAuthInfo,
      	uint dwCapabilities);
      
      public enum RpcAuthnLevel
      {
      	Default = 0,
      	None = 1,
      	Connect = 2,
      	Call = 3,
      	Pkt = 4,
      	PktIntegrity = 5,
      	PktPrivacy = 6
      }
      
      public enum RpcImpLevel
      {
      	Default = 0,
      	Anonymous = 1,
      	Identify = 2,
      	Impersonate = 3,
      	Delegate = 4
      }
      
      public enum EoAuthnCap
      {
      	None = 0x00,
      	MutualAuth = 0x01,
      	StaticCloaking = 0x20,
      	DynamicCloaking = 0x40,
      	AnyAuthority = 0x80,
      	MakeFullSIC = 0x100,
      	Default = 0x800,
      	SecureRefs = 0x02,
      	AccessControl = 0x04,
      	AppID = 0x08,
      	Dynamic = 0x10,
      	RequireFullSIC = 0x200,
      	AutoImpersonate = 0x400,
      	NoCustomMarshal = 0x2000,
      	DisableAAA = 0x1000
      }
      
      [DllImport("ole32.dll")]
      public static extern int CoInitializeSecurity(IntPtr pVoid, int cAuthSvc, IntPtr asAuthSvc, IntPtr pReserved1,
      	RpcAuthnLevel level, RpcImpLevel impers, IntPtr pAuthList, EoAuthnCap dwCapabilities, IntPtr pReserved3);
      
      static void Main(string[] args)
      {
      	var hres1 = CoSetProxyBlanket(null, 0, 0, null, 0, 0, IntPtr.Zero, 0); // Noncompliant
      
      	var hres2 = CoInitializeSecurity(IntPtr.Zero, -1, IntPtr.Zero, IntPtr.Zero, RpcAuthnLevel.None,
      		RpcImpLevel.Impersonate, IntPtr.Zero, EoAuthnCap.None, IntPtr.Zero); // Noncompliant
      }
      

      See

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                ann.campbell.2 Ann Campbell
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated: