Solved

How to use string.contains with a character array?

Posted on 2007-04-04
7
674 Views
Last Modified: 2008-01-09
In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

Currently I have this...

If not (myString.contains("/") OrElse myString.contains("\") OrElse myString.contains("..")) then
  ...
end if

Is there a faster way to do this check using something like a character array??
0
Comment
Question by:Rouchie
  • 3
  • 3
7 Comments
 
LVL 143

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 18849541
>In an attempt to prevent querystring injection attacks, I need to check if a string contains a variety of characters.

note that if you used parametrized queries, you don't need to worry about any "weird" characters at all...

using System.Data.SqlClient
-> the objects to be used are
SqlCommand
SqlParameter

that will be much better than what you seem to try to do...
0
 
LVL 25

Author Comment

by:Rouchie
ID: 18849576
Hi angelIII

It's not actually database work that I'm doing.  I have a page that shows details for various products, passed to the page via the querystring,

     i.e.  mypage.aspx?product=productXYZ

I then save this value into a private property that is then referenced by multiple subs etc.  One of the things I need to do is dynamically show an image based on the product.  
So,

   mypage.aspx?product=productXYZ

is used to generate an ImageURL of

  /images/productXYZ.jpg

However I realise here that there is danger of manually re-writing the querystring to load in other images, so I need to restrict what is allowed when the property is read.

Does that make sense...?
0
 
LVL 143

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 18849603
ok.

you might consider using the LIKE keyword
If not (myString like "*[/\]*") Or myString like "*..*" ) then
  ...
end if

http://getdotnetco.web119.discountasp.net/GdncStore/free/Articles/Intoduction%20to%20the%20VB%20NET%20Like%20Operator.htm
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 25

Author Comment

by:Rouchie
ID: 18849639
Okay I think I follow what you're saying.  Would it be possible to use this approach and make the process even simpler by saying something like this:

 if myString contains only [a-z] then
   ...
 end

I can't figure out if that's possible using LIKE.

Thanks.
0
 
LVL 143

Accepted Solution

by:
Guy Hengel [angelIII / a3] earned 500 total points
ID: 18849693
yes, with double negation:

If not (myString.ToLower like "*[^a-z]*") ) then
  ...
end if

so if there is nothing that is NOT a-z
0
 
LVL 2

Expert Comment

by:balochdude
ID: 18849704
Here is what i do when i dont want users to see whats going on in the querystring.

Response.Redirect(ResolveUrl("mypage.aspx?product=" & MySite.Security.EncryptText("productXYZ")))


Imports Microsoft.VisualBasic
Imports System.Text.RegularExpressions
Imports System
Imports System.IO
Imports System.Xml
Imports System.Text
Imports System.Security.Cryptography

Namespace MySite

Public Class Security

#Region " Encrypt/Decrypt "

        ''' <summary>
        ''' Encrypt the text
        ''' </summary>
        Public Shared Function EncryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Encrypt(strText, "%&#@?,:*").Replace("+", "|")
            Else
                Return Encrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' Decrypt the text
        ''' </summary>
        Public Shared Function DecryptText(ByVal strText As String, _
                Optional ByVal removePlus As Boolean = True) As String
            If removePlus Then
                Return Decrypt(strText.Replace("|", "+"), "%&#@?,:*")
            Else
                Return Decrypt(strText, "%&#@?,:*")
            End If
        End Function

        ''' <summary>
        ''' The function used to encrypt the text
        ''' </summary>
        Private Shared Function Encrypt(ByVal strText As String, ByVal strEncrKey _
                 As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(strEncrKey, 8))

                Dim des As New DESCryptoServiceProvider()
                Dim inputByteArray() As Byte = Encoding.UTF8.GetBytes(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateEncryptor(byKey, IV), CryptoStreamMode.Write)
                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Return Convert.ToBase64String(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

        ''' <summary>
        ''' The function used to decrypt the text
        ''' </summary>
        Private Shared Function Decrypt(ByVal strText As String, ByVal sDecrKey _
                   As String) As String
            Dim byKey() As Byte = {}
            Dim IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}
            Dim inputByteArray(strText.Length) As Byte

            Try
                byKey = System.Text.Encoding.UTF8.GetBytes(Left(sDecrKey, 8))
                Dim des As New DESCryptoServiceProvider()
                inputByteArray = Convert.FromBase64String(strText)
                Dim ms As New MemoryStream()
                Dim cs As New CryptoStream(ms, des.CreateDecryptor(byKey, IV), CryptoStreamMode.Write)

                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Dim encoding As System.Text.Encoding = System.Text.Encoding.UTF8

                Return encoding.GetString(ms.ToArray())

            Catch ex As Exception
                Return ex.Message
            End Try

        End Function

#End Region

End Class

End Namespace
0
 
LVL 25

Author Comment

by:Rouchie
ID: 18850016
angelIII you are an absolute mine of knowledge!  Once again, thanks for help me out :-)
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Today is the age of broadband.  More and more people are going this route determined to experience the web and it’s multitude of services as quickly and painlessly as possible. Coupled with the move to broadband, people are experiencing the web via …
International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question