c# - 服务器端请求伪造强化修复

Question

我正在尝试调用网络服务。此网络服务调用取决于用户输入的 URL。

URL 如下所示:

https://someurl.com/somefunction/{userinput}

我的函数是这样的

public async Task<Data> GetData(string input)
{
    try
    {
        Address = BaseAddress; // https://someurl.com/somefunction/{userinput}
        Address = Address.Replace("{userinput}", input);
        ....
        WebService ws = await base.GetData(httpClient, serverIPaddress);
        ....
    }
}

我从 Fortify 收到安全错误

Server-Side Request Forgery (Input Validation and Representation, Data Flow)

The function GetAsync() on line 122 initiates a network connection to a third-party system using user-controlled data for resource URI. An attacker may leverage this vulnerability to send a request on behalf of the application server since the request will originate from the application server's internal IP address.

建议如下:

建议:

Do not establish network connections based on user-controlled data and ensure that the request is being sent to the expected destination. If user data is necessary to build the destination URI, use a level of indirection: create a list of legitimate resource names that a user is allowed to specify, and only allow the user to select from the list. With this approach the input provided by the user is never used directly to specify the resource name.

In some situations this approach is impractical because the set of legitimate resource names is too large or too hard to keep track of. Programmers often resort to blacklisting in these situations. Blacklisting selectively rejects or escapes potentially dangerous characters before using the input. However, any such list of unsafe characters is likely to be incomplete and will almost certainly become out of date. A better approach is to create a whitelist of characters that are allowed to appear in the resource name and accept input composed exclusively of characters in the approved set.

Also, if required, make sure that the user input is only used to specify a resource on the target system but that the URI scheme, host, and port is controlled by the application. This way the damage that an attacker is able to do will be significantly reduced.

但问题是我确实需要根据用户提供的数据更改 {userinput}。 {userinput} 将是一个具有特定最大长度的字符串。如何解决这个问题？

Answer 1

经过如此多的研究和尝试尝试，我终于通过将输入附加到 BaseAddress

来实现这一点

示例代码看起来像

public async Task<Data> GetData(string input)
{
    try
    {
        var httpClient = new HttpClient();
        httpClient.BaseAddress = new Uri($"https://someurl.com/somefunction/{input}");
        var content = await httpClient.GetStringAsync("");
        return JsonConvert.DeserializeObject<Data>(content);
    }
}