asp.net of C anti sql injection component implementation code
- 2020-05-07 19:27:31
- OfStack
In the server security column, I wrote an article titled "cracking the general Sql anti-injection method". I said that some general anti-injection methods do not filter the cookie data, which will leave an opportunity for hackers. Of course, my code also filters the submitted cookie data.
Code:
In practice, we add the top and bottom lines in the configuration section of the Web.config file
Here is the sample code:
And in Web.Config file < SYSTEM.WEB > Plus the following code. Here is the sample code:
Code:
using System;
using System.Configuration;
using System.Web;
using System.Globalization;
namespace JNYW.StuM.SqlInject
{
public class SqlstrAny : IHttpModule
{
public void Init(HttpApplication application)
{
application.BeginRequest += (new
EventHandler(this.Application_BeginRequest));
}
private void Application_BeginRequest(Object source, EventArgs e)
{
ProcessRequest pr = new ProcessRequest();
pr.StartProcessRequest();
}
public void Dispose()
{
}
}
public class ProcessRequest
{
private static string SqlStr = System.Configuration.ConfigurationManager.AppSettings["SqlInject"].ToString();
private static string sqlErrorPage = System.Configuration.ConfigurationSettings.AppSettings["SQLInjectErrPage"].ToString();
///
/// Used to identify whether or not a stream is being transmitted
///
///
///
bool IsUploadRequest(HttpRequest request)
{
return StringStartsWithAnotherIgnoreCase(request.ContentType, "multipart/form-data");
}
///
/// Comparison content type
///
///
///
///
private static bool StringStartsWithAnotherIgnoreCase(string s1, string s2)
{
return (string.Compare(s1, 0, s2, 0, s2.Length, true, CultureInfo.InvariantCulture) == 0);
}
//SQL Injection attack code analysis
#region SQL Injection attack code analysis
///
/// Process user submitted requests
///
public void StartProcessRequest()
{
HttpRequest Request = System.Web.HttpContext.Current.Request;
HttpResponse Response = System.Web.HttpContext.Current.Response;
try
{
string getkeys = "";
if (IsUploadRequest(Request)) return; // Exit if it's a stream pass
// String parameter
if (Request.QueryString != null)
{
for (int i = 0; i < Request.QueryString.Count; i++)
{
getkeys = Request.QueryString.Keys[i];
if (!ProcessSqlStr(Request.QueryString[getkeys]))
{
Response.Redirect(sqlErrorPage + "?errmsg=QueryString Contains an illegal string &sqlprocess=true");
Response.End();
}
}
}
//form parameter
if (Request.Form != null)
{
for (int i = 0; i < Request.Form.Count; i++)
{
getkeys = Request.Form.Keys[i];
if (!ProcessSqlStr(Request.Form[getkeys]))
{
Response.Redirect(sqlErrorPage + "?errmsg=Form Contains an illegal string &sqlprocess=true");
Response.End();
}
}
}
//cookie parameter
if (Request.Cookies != null)
{
for (int i = 0; i < Request.Cookies.Count; i++)
{
getkeys = Request.Cookies.Keys[i];
if (!ProcessSqlStr(Request.Cookies[getkeys].Value))
{
Response.Redirect(sqlErrorPage + "?errmsg=Cookie Contains an illegal string &sqlprocess=true");
Response.End();
}
}
}
}
catch
{
// Error handling : Process user submissions !
Response.Clear();
Response.Write("CustomErrorPage Configuration error ");
Response.End();
}
}
///
/// Analyze whether the user request is normal
///
/// Incoming user submission data
/// Return whether or not SQL Injection attack code
private bool ProcessSqlStr(string Str)
{
bool ReturnValue = true;
try
{
if (Str != "")
{
string[] anySqlStr = SqlStr.Split('|');
foreach (string ss in anySqlStr)
{
if (Str.IndexOf(ss) >= 0)
{
ReturnValue = false;
break;
}
}
}
}
catch
{
ReturnValue = false;
}
return ReturnValue;
}
#endregion
}
}
In practice, we add the top and bottom lines in the configuration section of the Web.config file
Here is the sample code:
<!-- Anti-injection setting -->
<add value="and |exec |insert |select |delete |update |count | * |chr |mid |master |truncate |char |declare " key="SQLInject" />
<add value="ShowErr.aspx" key="SQLInjectErrPage" />
And in Web.Config file < SYSTEM.WEB > Plus the following code. Here is the sample code:
<!-- Anti-injection setting -->
<HTTPMODULES>
<aDD name="SqlstrAny" type="JNYW.StuM.SqlInject.SqlstrAny,SqlstrAny" />
</HTTPMODULES>