Code

Security Awareness

When theory meets practice for secure development

Presented By: Ivan Zlatanov

Prepared By: ICB's Internal Security Team

Security Awareness When theory meets practice for secure development Presented By: Ivan Zlatanov Prepared By: ICB's Internal Security Team

	[HttpPost]
	public IActionResult ProcessData([FromBody] byte[] serializedData)
	{
	var formatter = new BinaryFormatter();
	using (var ms = new MemoryStream(serializedData))
	{
	// Deserializing user-provided data
	var obj = formatter.Deserialize(ms);
	ProcessObject(obj); // Perform some actions with the deserialized object
	}

	return Ok();
	}

	private void ProcessObject(object obj)
	{
	// Simulating processing
	Console.WriteLine(obj.ToString());
	}

	public class SafeBinder : SerializationBinder
	{
	public override Type BindToType(string assemblyName, string typeName)
	{
	var allowedTypes = new[] { typeof(MySafeObject) };
	var type = Type.GetType($"{typeName}, {assemblyName}");

	if (type != null && allowedTypes.Contains(type))
	{
	return type;
	}
	throw new SerializationException("Unauthorized type detected.");
	}
	}
	[HttpPost]
	public IActionResult ProcessData([FromBody] byte[] serializedData)
	{
	var formatter = new BinaryFormatter
	{
	Binder = new SafeBinder()
	};
	using (var ms = new MemoryStream(serializedData))
	{
	var obj = formatter.Deserialize(ms);
	ProcessObject(obj);
	}
	return Ok();
	}

	[HttpGet]
	public IActionResult GetFile(string filename)
	{
	string path = Path.Combine("C:\\Files", filename);
	if (System.IO.File.Exists(path))
	{
	return PhysicalFile(path, "application/octet-stream");
	}
	return NotFound("File not found");
	}

	// Similar code can introduce vulnerability to blobs and other storage units.

	[HttpGet]
	public IActionResult GetFile(string filename)
	{
	// Ensure filename contains no directory traversal
	string sanitizedFilename = Path.GetFileName(filename);
	string path = Path.Combine("C:\\Files", sanitizedFilename);

	if (System.IO.File.Exists(path))
	{
	return PhysicalFile(path, "application/octet-stream");
	}
	return NotFound("File not found");
	}

	[HttpPost]
	public IActionResult Execute(string command)
	{
	var process = new Process
	{
	StartInfo = new ProcessStartInfo
	{
	FileName = "cmd.exe",
	Arguments = "/C " + command,
	RedirectStandardOutput = true,
	UseShellExecute = false,
	CreateNoWindow = true
	}
	};
	process.Start();
	string result = process.StandardOutput.ReadToEnd();
	return Ok(result);
	}

	[HttpPost]
	public IActionResult ExecuteSafe(string operation)
	{
	if (operation == "list")
	{
	string[] files = Directory.GetFiles("C:\\Files");
	return Ok(files);
	}
	return BadRequest("Invalid operation");
	}

	[HttpGet]
	public IActionResult GetUser(string username)
	{
	string query = $"SELECT * FROM Users WHERE Username = '{username}'";
	using (var connection = new SqlConnection("your_connection_string"))
	{
	var command = new SqlCommand(query, connection);
	connection.Open();
	var reader = command.ExecuteReader();
	// Process the results
	}
	return Ok();
	}

	[HttpGet]
	public IActionResult Greet(string name)
	{
	return Content($"<h1>Welcome, {name}</h1>", "text/html");
	}

	[HttpGet]
	public IActionResult Greet(string name)
	{
	string sanitized = System.Net.WebUtility.HtmlEncode(name);
	return Content($"<h1>Welcome, {sanitized}</h1>", "text/html");
	}

	var token = new JwtSecurityToken(
	issuer: "myapp",
	audience: "myaudience",
	claims: claims,
	expires: DateTime.UtcNow.AddDays(1),
	signingCredentials: new SigningCredentials(
	new SymmetricSecurityKey(Encoding.UTF8.GetBytes("random-weak-key")),
	SecurityAlgorithms.HmacSha256
	)
	);

	webSocket.OnMessage += async (sender, e) =>
	{
	var message = Encoding.UTF8.GetString(e.RawData); // No validation
	await ProcessMessage(message); // Allows potentially harmful input
	};

	webSocket.OnMessage += async (sender, e) =>
	{
	var message = Encoding.UTF8.GetString(e.RawData);
	if (!IsValidJson(message))
	{
	await webSocket.CloseAsync();
	return;
	}
	await ProcessMessage(message);
	};

	private bool IsValidJson(string input)
	{
	try
	{
	JToken.Parse(input); // Validate input as JSON
	return true;
	}
	catch
	{
	return false;
	}
	}