Details

    • Type: Language-Specification
    • Status: Active
    • Resolution: Unresolved
    • Labels:
      None
    • Impact:
      Unknown 'null' severity
    • Likelihood:
      Unknown 'null' severity

      Description

      Exposing HTTP endpoints is security-sensitive. It has led in the past to the following vulnerabilities:

      HTTP endpoints are webservices' main entrypoint. Attackers will take advantage of any vulnerability by sending crafted inputs for headers (including cookies), body and URI. No input should be trusted and extreme care should be taken with all returned value (header, body and status code).

      This rule flags code which creates HTTP endpoint via .Net Framework MVC Controllers. It guides security code reviews to security-sensitive code.

      Questionable Code Example

      public class Foo : System.Web.Mvc.Controller
      {
          public string MyProperty
          {
              get { return "test"; }
              set { }
          }
          public Foo() { }
      
          public void PublicFoo() // Questionable. Public Controller methods are exposed as HTTP endpoints.
          {
              // ...
          }
          [System.Web.Mvc.NonAction]
          public void NotAnEndpoint() // This is not an endpoint because of the NonAction attribute.
          { }
          protected void ProtectedFoo() { }
          internal void InternalFoo() { }
          private void PrivateFoo() { }
          private class Bar : System.Web.Mvc.Controller
          {
              public void InnerFoo() { }
          }
      }
      

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              nicolas.harraudeau Nicolas Harraudeau
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated: