Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.
Solved
A cross-site and a file canonicalization problems
Posted on 2011-03-04
Hi. I'm analyzing my code C# with CAT.NET Code Analysis and getting "Sanitize the file path prior to passing it to file system routines" message for File.Move(Path + "\\...
and a cross-site redirection vulnerability “Do not allow off-site redirections to absolute URLs that can be specified by the user” for Response.Redirect("file:" + Path + "\\...
Is there any solution to these problem? Thanks!
protected void Button1_Click(object sender, EventArgs e)
{
if (FileExt == "aa")
{
if (ListBox1.SelectedValue == "")
{
Response.Redirect("Page1.a
}
else
{
Response.Redirect("file:" + Path + "\\filepath_aa\\" + Status + "\\" + ListBox1.SelectedValue);
}
}
else if (FileExt == "bb")
{
if (ListBox1.SelectedValue == "")
{
Response.Redirect("Page1.a
}
else
{
Response.Redirect("file:" + Path + "\\filepath_bb\\" + Status + "\\" + ListBox1.SelectedValue);
}
}
}
protected void Button2_Click(object sender, EventArgs e)
{
if (FileExt == "aa")
{
if (Status == "New")
{
if (ListBox1.SelectedValue == "")
{
Response.Redirect("Page1.a
}
else
{
File.Move(Path + "\\filepath_aa\\New\\" + ListBox1.SelectedValue, Path + "\\filepath_aa\\New\\New_I
}
}
else if (Status == "Closed")
{
if (ListBox1.SelectedValue == "")
{
Response.Redirect("Page1.a
}
else
{
File.Move(Path + "\\filepath_aa\\Closed\\" + ListBox1.SelectedValue, Path + "\\filepath_aa\\Closed\\Cl
}
}…
and a cross-site redirection vulnerability “Do not allow off-site redirections to absolute URLs that can be specified by the user” for Response.Redirect("file:" + Path + "\\...
Is there any solution to these problem? Thanks!
protected void Button1_Click(object sender, EventArgs e)
{
if (FileExt == "aa")
{
if (ListBox1.SelectedValue == "")
{
Response.Redirect("Page1.a
}
else
{
Response.Redirect("file:" + Path + "\\filepath_aa\\" + Status + "\\" + ListBox1.SelectedValue);
}
}
else if (FileExt == "bb")
{
if (ListBox1.SelectedValue == "")
{
Response.Redirect("Page1.a
}
else
{
Response.Redirect("file:" + Path + "\\filepath_bb\\" + Status + "\\" + ListBox1.SelectedValue);
}
}
}
protected void Button2_Click(object sender, EventArgs e)
{
if (FileExt == "aa")
{
if (Status == "New")
{
if (ListBox1.SelectedValue == "")
{
Response.Redirect("Page1.a
}
else
{
File.Move(Path + "\\filepath_aa\\New\\" + ListBox1.SelectedValue, Path + "\\filepath_aa\\New\\New_I
}
}
else if (Status == "Closed")
{
if (ListBox1.SelectedValue == "")
{
Response.Redirect("Page1.a
}
else
{
File.Move(Path + "\\filepath_aa\\Closed\\" + ListBox1.SelectedValue, Path + "\\filepath_aa\\Closed\\Cl
}
}…
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
2 Comments
I think your ListBox1.SelectedValue variable is causing the problem.
Try validating ListBox1.SelectedValue against the list used to populate it. This is to garantee that the user did not temper with the values. Maybe something like this:
If Path and Status also come from user input they need to be validated also.
I hope this helps.
Try validating ListBox1.SelectedValue against the list used to populate it. This is to garantee that the user did not temper with the values. Maybe something like this:
Dim validValues As HashSet(Of String)
Dim selectedValue As String
selectedValue = validValues(ListBox1.SelectedValue)
...
Response.Redirect("file:" + Path + "\\filepath_aa\\" + Status + "\\" + selectedValue);
If Path and Status also come from user input they need to be validated also.
I hope this helps.
Featured Post
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
This article introduced a TextBox that supports transparent background.
Introduction
TextBox is the most widely used control component in GUI design. Most GUI controls do not support transparent background and more or less do not have the…
Performance in games development is paramount: every microsecond counts to be able to do everything in less than 33ms (aiming at 16ms). C# foreach statement is one of the worst performance killers, and here I explain why.
This course is ideal for IT System Administrators working with VMware vSphere and its associated products in their company infrastructure. This course teaches you how to install and maintain this virtualization technology to store data, prevent vuln…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
Suggested Courses
Course of the Month9 days, 16 hours left to enroll
722 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.