Popular asp.net ValidateRequest filter rule

 

 

The source code of the. net4.0 check is extracted as follows:

 

 

 

/// Here, the pseudo Portal

 

/// </Summary>

 

/// <Param name = "s"> </param>

 

/// <Returns> </returns>

 

Private static bool IsDangerousString (string s)

 

{

 

// Remove \ 0 first

 

S = RemoveNullCharacters (s );

 

Int macount = 0;

 

Return IsDangerousString (s, out macount );

 

}

 

 

 

/// <Summary>

 

/// Remove character Truncation

 

/// </Summary>

 

/// <Param name = "s"> </param>

 

/// <Returns> </returns>

 

Private static string RemoveNullCharacters (string s)

 

{

 

If (s = null)

 

{

 

Return null;

 

}

 

If (s. IndexOf ('\ 0')>-1)

 

{

 

Return s. Replace ("\ 0", string. Empty );

 

}

 

Return s;

 

}

 

 

 

 

 

Static char [] startingChars = new char [] {'<','&'};

 

 

 

Private static bool IsAtoZ (char c)

 

{

 

Return (c> = 'A') & (c <= 'Z') | (c> = 'A ') & (c <= 'Z ')));

 

}

 

 

 

/// <Summary>

 

/// 1. No <and & certainly

 

/// 2. <followed by a letter or! /? None

 

/// 3. & # No

 

/// </Summary>

 

/// <Param name = "s"> </param>

 

/// <Param name = "matchIndex"> </param>

 

/// <Returns> </returns>

 

Internal static bool IsDangerousString (string s, out int matchIndex)

 

{

 

MatchIndex = 0;

 

Int startIndex = 0;

 

While (true)

 

{

 

Int num2 = s. IndexOfAny (startingChars, startIndex );

 

If (num2 <0)

 

{

 

Return false;

 

}

 

If (num2 = (s. Length-1 ))

 

{

 

Return false;

 

}

 

MatchIndex = num2;

 

Char ch = s [num2];

 

If (ch! = '&')

 

{

 

If (ch = '<') & (IsAtoZ (s [num2 + 1]) | (s [num2 + 1] = '! ') | (S [num2 + 1] ='/') | (s [num2 + 1] = '? '))))

 

{

 

Return true;

 

}

 

}

 

Else if (s [num2 + 1] = '#')

 

{

 

Return true;

 

}

 

StartIndex = num2 + 1;

 

}

 

}

 

 

 

Summary

 

1. Do not appear <and & must be safe

 

2. It is safe to only show <or & single characters

 

3. <a-Z,/,! appears ,/,! ,? Is insecure

 

4. & appears later # It is insecure

 

5. None of the above are safe.

 

 

 

In combination with the filtering rules and ie features, we can find some bypass methods, such as in ie6

 

 

 

<~ /XSS/*-*/STYLE = xss: e/**/xpression (alert ('xsss')>

 

 

 

Reference

 

Http://www.procheckup.com/vulnerability_manager/documents/document_1258758664/bypassing-dot-NET-ValidateRequest.pdf

From: hi.baidu.com/cnqing