• Status: Solved
  • Priority: High
  • Security: Public
  • Views: 101
  • Last Modified:

C#: How comprehensive is this malicious URL test?

How comprehensive is this malicious URL test?

        public static bool IsUrlDomainValid(this Uri uri, List<string> whitelist)
        {
            return whitelist.Any(w => uri.Host.EndsWith(w));
        }

Open in new window


I create a while list that contains various good domains:

www.abc.com
www.xyz.com
www.123.com

and want this function to fail if there is a single domain that is not whitelisted.

Is that was this code does? I get worried with the use of "endswith"

What if the last domain is a good one, but there is a bad one in the middle?

Thanks
0
newbieweb
Asked:
newbieweb
3 Solutions
 
nociSoftware EngineerCommented:
endwith means:

if www.abc.com is ok, then anything that ends with www.abc.com is ok:
    123.www.abc.com
    def.www.abc.com
    whatever.www.abc.com

But not:
     123.abc.com
     whatever.abc.com

while for most Domains *.abc.com  belongs to abc.com (exceptions are domain names from ISP's and some counties:
england has 2 level domain name system    .co.uk  etc.  isp often have vanity names: custermer.isp.net  or the like.
0
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
As per above, seems that function was created to be used with DOMAIN.TLD and explicitly trust all subdomains
0
 
ambienceCommented:
What if the last domain is a good one, but there is a bad one in the middle?

Its a whitelist, bad one in the middle cannot appear.

Domain names are case-insensitive there following is preferrable

public static bool IsUrlDomainValid(this Uri uri, List<string> whitelist)
 {
    return whitelist.Any(w => uri.Host.EndsWith(w, StringComparison.CurrentCultureIgnoreCase));
}

Open in new window

0
 
newbiewebSr. Software EngineerAuthor Commented:
thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Network Scalability - Handle Complex Environments

Monitor your entire network from a single platform. Free 30 Day Trial Now!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now