Hi Folks,
I'm wondering what is the best way to retrieve form POST information while protecting yourself against malicious posts.
Eg. Imaging i have have some html (say, radio boxes) which have int values (yes, we know it's all strings getting passed through.. but just stick with me, here).
Traditionally, I would have done the following:
int x = this.ReadFromRequest<int>("RadioBox1");
Kewl! works fine .. until a malicious post (eg. a user hacking, using fiddler, etc..) posts a NON-INT to see what damage can be done. Of course, the ReadFromRequest will throw a cast exception. That's all well and good if u throw (boom tish) a Try/Catch
around all the ReadFromRequest methods .. but i prefer to not rely on exceptions to catch bad things and use prevention.
So ... what do other people to do 'check/validate' the user input data before they try doing stuff with it, in an MVC post?
:: Never underestimate the predictability of stupidity ::
from my point the easiest way is to use the int.TryParse(string s, out inst result) method e.g.
int x;
// verify the operation is successfull
if (int.TryParse(this.ReadFromRequest("RadioBox1"), out x))
{
// operation with int x
}
else
{
// malicious code
this.resultLabel.Text = "put your fingers from my site!"
}
Servus,
Klaus
I haven't the faintest idea, but great many therefrom.
klaus_b@.NET
Marked as answer by pure.krome on Apr 29, 2008 10:54 PM
int.Parse is a little verbose but it is the safest way to do it without wrapping everything in a try/catch
you can make your own ReadFromRequest<T>() where you use a try/catch or verify before you cast.
Better safe than sorry
I actually thought of that for a split second then rejected it because if i can, i NEVER handle try/catches when i know there's a better way WITHOUT having an exception thrown. Prevention is better than a cure.
I've been doing the TryParse method.
I did think of overriding the ReadFromRequest<T> which does a tryparse in there .. but to do that u need to know the datatype so i didn't bother. more hard work compared to the outcome.
:: Never underestimate the predictability of stupidity ::
pure.krome
Member
532 Points
349 Posts
Safe way to read from request? eg. protection from a malicious post
Apr 29, 2008 06:13 AM|LINK
Hi Folks,
I'm wondering what is the best way to retrieve form POST information while protecting yourself against malicious posts.
Eg. Imaging i have have some html (say, radio boxes) which have int values (yes, we know it's all strings getting passed through.. but just stick with me, here).
Traditionally, I would have done the following:
int x = this.ReadFromRequest<int>("RadioBox1");
Kewl! works fine .. until a malicious post (eg. a user hacking, using fiddler, etc..) posts a NON-INT to see what damage can be done. Of course, the ReadFromRequest will throw a cast exception. That's all well and good if u throw (boom tish) a Try/Catch around all the ReadFromRequest methods .. but i prefer to not rely on exceptions to catch bad things and use prevention.
So ... what do other people to do 'check/validate' the user input data before they try doing stuff with it, in an MVC post?
klaus_b
Contributor
2847 Points
566 Posts
Re: Safe way to read from request? eg. protection from a malicious post
Apr 29, 2008 10:24 AM|LINK
Hi pure.krome,
from my point the easiest way is to use the int.TryParse(string s, out inst result) method e.g.
int x; // verify the operation is successfull if (int.TryParse(this.ReadFromRequest("RadioBox1"), out x)) { // operation with int x } else { // malicious code this.resultLabel.Text = "put your fingers from my site!" }Klaus
I haven't the faintest idea, but great many therefrom.
klaus_b@.NET
srulyt
Participant
1073 Points
230 Posts
Re: Safe way to read from request? eg. protection from a malicious post
Apr 29, 2008 01:27 PM|LINK
int.Parse is a little verbose but it is the safest way to do it without wrapping everything in a try/catch
you can make your own ReadFromRequest<T>() where you use a try/catch or verify before you cast.
Better safe than sorry
pure.krome
Member
532 Points
349 Posts
Re: Safe way to read from request? eg. protection from a malicious post
Apr 29, 2008 10:52 PM|LINK
I actually thought of that for a split second then rejected it because if i can, i NEVER handle try/catches when i know there's a better way WITHOUT having an exception thrown. Prevention is better than a cure.
I've been doing the TryParse method.
I did think of overriding the ReadFromRequest<T> which does a tryparse in there .. but to do that u need to know the datatype so i didn't bother. more hard work compared to the outcome.