• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 682
  • Last Modified:

How to use string.contains with a character array?

In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

Currently I have this...

If not (myString.contains("/") OrElse myString.contains("\") OrElse myString.contains("..")) then
  ...
end if

Is there a faster way to do this check using something like a character array??
0
Rouchie
Asked:
Rouchie
  • 3
  • 3
1 Solution
 
Guy Hengel [angelIII / a3]Billing EngineerCommented:
>In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

note that if you used parametrized queries, you don't need to worry about any "weird" characters at all...

using System.Data.SqlClient
-> the objects to be used are
SqlCommand
SqlParameter

that will be much better than what you seem to try to do...
0
 
RouchieAuthor Commented:
Hi angelIII

It's not actually database work that I'm doing.  I have a page that shows details for various products, passed to the page via the querystring,

     i.e.  mypage.aspx?product=productXYZ

I then save this value into a private property that is then referenced by multiple subs etc.  One of the things I need to do is dynamically show an image based on the product.  
So,

   mypage.aspx?product=productXYZ

is used to generate an ImageURL of

  /images/productXYZ.jpg

However I realise here that there is danger of manually re-writing the querystring to load in other images, so I need to restrict what is allowed when the property is read.

Does that make sense...?
0
 
Guy Hengel [angelIII / a3]Billing EngineerCommented:
ok.

you might consider using the LIKE keyword
If not (myString like "*[/\]*") Or myString like "*..*" ) then
  ...
end if

http://getdotnetco.web119.discountasp.net/GdncStore/free/Articles/Intoduction%20to%20the%20VB%20NET%20Like%20Operator.htm
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
RouchieAuthor Commented:
Okay I think I follow what you're saying.  Would it be possible to use this approach and make the process even simpler by saying something like this:

 if myString contains only [a-z] then
   ...
 end

I can't figure out if that's possible using LIKE.

Thanks.
0
 
Guy Hengel [angelIII / a3]Billing EngineerCommented:
yes, with double negation:

If not (myString.ToLower like "*[^a-z]*") ) then
  ...
end if

so if there is nothing that is NOT a-z
0
 
balochdudeCommented:
Here is what i do when i dont want users to see whats going on in the querystring.

Response.Redirect(ResolveUrl("mypage.aspx?product=" & MySite.Security.EncryptText("productXYZ")))


Imports Microsoft.VisualBasic
Imports System.Text.RegularExpressions
Imports System
Imports System.IO
Imports System.Xml
Imports System.Text
Imports System.Security.Cryptography

Namespace MySite

Public Class Security

#Region " Encrypt/Decrypt "

        ''' <summary>
        ''' Encrypt the text
        ''' </summary>
        Public Shared Function EncryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Encrypt(strText, "%&#@?,:*").Replace("+", "|")
            Else
                Return Encrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' Decrypt the text
        ''' </summary>
        Public Shared Function DecryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Decrypt(strText.Replace("|", "+"), "%&#@?,:*")
            Else
                Return Decrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' The function used to encrypt the text
        ''' </summary>
        Private Shared Function Encrypt(ByVal strText As String, ByVal strEncrKey _
                 As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(strEncrKey, 8))

                Dim des As New DESCryptoServiceProvider()
                Dim inputByteArray() As Byte = Encoding.UTF8.GetBytes(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateEncryptor(byKey, IV), CryptoStreamMode.Write)
                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Return Convert.ToBase64String(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

        ''' <summary>
        ''' The function used to decrypt the text
        ''' </summary>
        Private Shared Function Decrypt(ByVal strText As String, ByVal sDecrKey _
                   As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}
            Dim inputByteArray(strText.Length) As Byte

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(sDecrKey, 8))
                Dim des As New DESCryptoServiceProvider()
                inputByteArray = Convert.FromBase64String(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateDecryptor(byKey, IV), CryptoStreamMode.Write)

                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Dim encoding As System.Text.Encoding = System.Text.Encoding.UTF8

                Return encoding.GetString(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

#End Region

End Class

End Namespace
0
 
RouchieAuthor Commented:
angelIII you are an absolute mine of knowledge!  Once again, thanks for help me out :-)
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now