Solved

How to use string.contains with a character array?

Posted on 2007-04-04
7
670 Views
Last Modified: 2008-01-09
In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

Currently I have this...

If not (myString.contains("/") OrElse myString.contains("\") OrElse myString.contains("..")) then
  ...
end if

Is there a faster way to do this check using something like a character array??
0
Comment
Question by:Rouchie
  • 3
  • 3
7 Comments
 
LVL 142

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 18849541
>In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

note that if you used parametrized queries, you don't need to worry about any "weird" characters at all...

using System.Data.SqlClient
-> the objects to be used are
SqlCommand
SqlParameter

that will be much better than what you seem to try to do...
0
 
LVL 25

Author Comment

by:Rouchie
ID: 18849576
Hi angelIII

It's not actually database work that I'm doing.  I have a page that shows details for various products, passed to the page via the querystring,

     i.e.  mypage.aspx?product=productXYZ

I then save this value into a private property that is then referenced by multiple subs etc.  One of the things I need to do is dynamically show an image based on the product.  
So,

   mypage.aspx?product=productXYZ

is used to generate an ImageURL of

  /images/productXYZ.jpg

However I realise here that there is danger of manually re-writing the querystring to load in other images, so I need to restrict what is allowed when the property is read.

Does that make sense...?
0
 
LVL 142

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 18849603
ok.

you might consider using the LIKE keyword
If not (myString like "*[/\]*") Or myString like "*..*" ) then
  ...
end if

http://getdotnetco.web119.discountasp.net/GdncStore/free/Articles/Intoduction%20to%20the%20VB%20NET%20Like%20Operator.htm
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 25

Author Comment

by:Rouchie
ID: 18849639
Okay I think I follow what you're saying.  Would it be possible to use this approach and make the process even simpler by saying something like this:

 if myString contains only [a-z] then
   ...
 end

I can't figure out if that's possible using LIKE.

Thanks.
0
 
LVL 142

Accepted Solution

by:
Guy Hengel [angelIII / a3] earned 500 total points
ID: 18849693
yes, with double negation:

If not (myString.ToLower like "*[^a-z]*") ) then
  ...
end if

so if there is nothing that is NOT a-z
0
 
LVL 2

Expert Comment

by:balochdude
ID: 18849704
Here is what i do when i dont want users to see whats going on in the querystring.

Response.Redirect(ResolveUrl("mypage.aspx?product=" & MySite.Security.EncryptText("productXYZ")))


Imports Microsoft.VisualBasic
Imports System.Text.RegularExpressions
Imports System
Imports System.IO
Imports System.Xml
Imports System.Text
Imports System.Security.Cryptography

Namespace MySite

Public Class Security

#Region " Encrypt/Decrypt "

        ''' <summary>
        ''' Encrypt the text
        ''' </summary>
        Public Shared Function EncryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Encrypt(strText, "%&#@?,:*").Replace("+", "|")
            Else
                Return Encrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' Decrypt the text
        ''' </summary>
        Public Shared Function DecryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Decrypt(strText.Replace("|", "+"), "%&#@?,:*")
            Else
                Return Decrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' The function used to encrypt the text
        ''' </summary>
        Private Shared Function Encrypt(ByVal strText As String, ByVal strEncrKey _
                 As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(strEncrKey, 8))

                Dim des As New DESCryptoServiceProvider()
                Dim inputByteArray() As Byte = Encoding.UTF8.GetBytes(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateEncryptor(byKey, IV), CryptoStreamMode.Write)
                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Return Convert.ToBase64String(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

        ''' <summary>
        ''' The function used to decrypt the text
        ''' </summary>
        Private Shared Function Decrypt(ByVal strText As String, ByVal sDecrKey _
                   As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}
            Dim inputByteArray(strText.Length) As Byte

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(sDecrKey, 8))
                Dim des As New DESCryptoServiceProvider()
                inputByteArray = Convert.FromBase64String(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateDecryptor(byKey, IV), CryptoStreamMode.Write)

                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Dim encoding As System.Text.Encoding = System.Text.Encoding.UTF8

                Return encoding.GetString(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

#End Region

End Class

End Namespace
0
 
LVL 25

Author Comment

by:Rouchie
ID: 18850016
angelIII you are an absolute mine of knowledge!  Once again, thanks for help me out :-)
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Calculating holidays and working days is a function that is often needed yet it is not one found within the Framework. This article presents one approach to building a working-day calculator for use in .NET.
International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

778 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question