javascript - HTTP参数污染攻击

Question

我开发了一个 Web 应用程序并部署到服务器中，我的安全团队提出了以下安全修复问题。

反射 HTML 参数污染 (HPP) 是一种注入(inject)漏洞，当攻击者可以注入(inject)分隔符并更改应用程序生成的 URL 参数时，就会发生这种漏洞。攻击的后果取决于应用程序的功能，但可能包括访问和潜在地利用不可控的变量、进行其他攻击(例如跨站点请求伪造)或以意外的方式改变应用程序行为。建议包括使用严格的验证输入来确保服务器正确处理编码的参数分隔符“%26”，并在应用程序生成的链接或其他形式的输出中包含用户提供的内容时使用 URL 编码。 >

任何人都可以知道如何防止 ASP.NET 中的 HTML 参数污染

这是网页中的脚本代码

<script type="text/javascript" language="javascript">

        document.onclick = doNavigationCheck ;  
        var srNumberFinal="";

        function OpenDetailsWindow(srNumber)
        {    
            window.open("xxx.aspx?SRNumber="+srNumber+ "","","minimize=no,maximize=no,scrollbars=yes,status=no,toolbar=no,menubar=no,location=no,width=800,directories=no,resizable=yes,titlebar=no");
        }

        function OpenPrintWindow()
        {
            var querystrActivityId = "<%=Request.QueryString["activityId"]%>";

            if(querystrActivityId != "")
            {
                var url = "abc.aspx?id=" + "<%=Request.QueryString["id"]%>" + "&activityId=" + querystrActivityId + "";
            }
            else
            {

                var hdrActivityId = document.getElementById('<%=uxHdnHdrActivityId.ClientID%>').value;
                var url = "PrintServiceRequestDetail.aspx?id=" + "<%=Request.QueryString["id"]%>" + "&activityId=" + hdrActivityId + "";
            }

            childWinReference=window.open(url, "ChildWin","minimize=yes,maximize=yes,scrollbars=yes,status=yes,toolbar=no,menubar=yes,location=no,directories=no,resizable=yes,copyhistory=no");
            childWinReference.focus();
        }

        function NavigateSRCopy(srNumber)
        {    
            srNumberFinal = srNumber;

            if (srNumber != "undefined" && srNumber != null && srNumber != "")
            {
                new Ajax.Request('<%= (Request.ApplicationPath != "/") ? Request.ApplicationPath : string.Empty %>/xxx/AutoCompleteService.asmx/CheckFormID'
                                        , { method: 'post', postBody: 'srNumber=' + srNumber, onComplete: SearchResponse });
            }
        }

        function SearchResponse(xmlResponse)
        {
            var xmlDoc;

            try //Internet Explorer
            {
                xmlDoc=new ActiveXObject("Microsoft.XMLDOM");
                xmlDoc.async="false";
                xmlDoc.loadXML(xmlResponse.responseText);
            }  
            catch(e)
            {
                try // Firefox, Mozilla, Opera, etc.
                {
                    parser=new DOMParser();
                    xmlDoc=parser.parseFromString(xmlResponse.responseText,"text/xml");
                }
                catch(e)
                {
                    alert(e.message);   
                    return;
                }
            }

            if(xmlDoc.getElementsByTagName("string")[0].childNodes[0] != null)
            {
                formID = xmlDoc.getElementsByTagName("string")[0].childNodes[0].nodeValue; 
            }
            else
            {
                formID = null;
            }

            if(formID != null && formID != "")
            {          
                window.location.href = '/CustomerSupportRequest/CreateServiceRequest.aspx?id=' + formID + '&TemplateSR=' + srNumberFinal + '&Frompage=CopySR';

                return true;
            }
            else
            {    
                alert("This Service Request cannot be copied because it meets at least one of these conditions: \t\t\n\n        * It was created prior to 10/15/2008 \n        * It was auto generated as part of the Report Requeue Process \n        * It was auto generated as part of the ERA Requeue Process \n        * It was not created online");
            }
        }

        function UpdateChildCases()
        {
            var modalPopup = $find('modalParentChildComments');
            modalPopup.show(); 
        }

        function HideParentChildPopup()
        {
            var modalPopup = $find('modalParentChildComments');
            modalPopup.hide(); 
            return false;
        }

        function HideErrorSRNumsPopup()
        {
            var modalPopup = $find('modalParentErrorSRNumDisplay');
            modalPopup.hide(); 
            return false;
        }

        function HideRetrySRNumsPopup()
        {
            var modalPopup = $find('modalRetrySRNumDisplay');
            modalPopup.hide(); 
            return false;
        }

        function RemoveParent_ChildFlag(type)
        {
            var childCases = document.getElementById("<%=uxHdnChildCases.ClientID %>");
            var msg = "";
            var btn;

            if(type == "Child")
            {
                if(childCases.value.indexOf(',') != -1)
                    msg = "Are you sure you want to remove the Child flag from this Service Request?";
                else   
                    msg = "This is the only child associated to the parent case.  Removing the child flag will also remove the parent flag from the associated case.  Choose OK to remove the flags, or Cancel to close this dialog";

                btn = document.getElementById('<%=uxRemoveChildFlag.ClientID%>');
            }   
            else
            {
                msg = "Removing the parent flag from this case will also remove the child flag from all associated cases.  Are you sure you want to remove the Parent flag from this Service Request?";
                btn = document.getElementById('<%=uxRemoveParentFlag.ClientID%>');
            }

            if(btn)
            {
                if(!confirm(msg))
                {
                    return false;   
                }
                else
                {
                    btn.click();
                }
            } 
        }

        function limitTextForParentChildComments() 
        {   
            var objLblCharCount = document.getElementById('uxLblPCCharCount');
            var objTxtComments = document.getElementById('<%=txtParentComment.ClientID%>');

            if (objTxtComments.value.length > 1500) 
            {
                objTxtComments.value = objTxtComments.value.substring(0, 1500);
            } 
            else 
            {
                objLblCharCount.innerHTML = 1500 - objTxtComments.value.length + " ";
            }

            setTimeout("limitTextForParentChildComments()",50);
        }

        function ValidateInputs()
        {
            var lblErrorMessage = document.getElementById('<%=lblCommentErrorTxt.ClientID%>');
            var objTxtComments = document.getElementById('<%=txtParentComment.ClientID%>');

            if(objTxtComments.value.trim() == "")
            {
                lblErrorMessage.style.display = "block";
                return false;
            }
        }

    </script>

Answer 1

根据 OWASP Testing for HTTP Parameter pollution ，ASP.NET 不容易受到 HPP 的影响，因为 ASP.NET 将返回所有出现的用逗号连接的查询字符串值(例如 color=red&color=blue 给出 color=red,blue)。

参见here示例说明。

也就是说，您的代码似乎容易受到 XSS 的攻击相反:

var querystrActivityId = "<%=Request.QueryString["activityId"]%>";

如果查询字符串参数 activityId=";alert('xss');" (当然是 URL 编码)，那么您的应用程序将触发一个警报框，因为此代码将在你的脚本标签。

var querystrActivityId = ""; alert('xss');"";