6

I have an application which use the Thick box jQuery component to open a popup page .

And I pass my parameters in query string like this :

 <a id="btnShowPopup6" runat="server" class="thickbox" href='<%#"RollUp.aspx?TCode="+Eval("Code")+"...."+"&AR=1"+"&TBiframe=true&height=530&width=750"%>'>

This 's the only choice I have, I can't use session variables with this method or post parameters so just the query string way.

How can I secure my query string so the user can't play with them? What's the best way to encrypt my query string?

Improve this question
6
  • 3
    What's that eval in there for? It worries me. – Polynomial Dec 19 '12 at 14:21
  • set of important parameters which according to them get specific documents so if the user play with these parameters he can get other documents. – Anyname Donotcare Dec 19 '12 at 14:26
  • 1
    No, you have an Eval() call in there. What's that for? Are you putting user parameters into an eval? – Polynomial Dec 19 '12 at 14:35
  • yes this Eval() comes from grid view data source ,when the user click on the link above it goes to the RollUp.aspx with these eval parameters . – Anyname Donotcare Dec 19 '12 at 14:37
  • 3
    That's a pretty bad idea. – Polynomial Dec 19 '12 at 14:40
5

Putting user-provided values into an eval() call is a horrible idea, because it essentially amounts to a remote code execution vulnerability. Let's say your code looks like this...

var data = eval(webRequest.Parameters["p"]);

Now imagine I put this into the p parameter...

System.IO.File.Delete(@"c:\windows\system32\ntoskrnl.exe");

Whoops! I just deleted your kernel.

No amount of messing around with escaping will work here - it's a fundamentally broken concept.

Encrypting parameters does nothing but complicate things. Go for the correct approach, and use a session variable like the language is designed to do.

Update: To be clear, I'm talking about eval() in a generic sense. If you're using the Eval binding method on a data controller in C#, you should be OK as long as no user parameters go in there, otherwise they can cause your code to dump out arbitrary values from your database, without even needing SQL injection.

Improve this answer
11
  • 1
    Never. Avoid it like the plague. It's the security equivalent of goto. – Polynomial Dec 19 '12 at 14:56
  • 1
    Is this Eval a method of an object? I'm not familiar with ASP.NET (I'm a WinForms guy) - it may be ok if you're using it to bind to a data controller, but not if you accept user supplied values into your eval parameter. – Polynomial Dec 19 '12 at 15:10
  • 1
    See my updated answer. – Polynomial Dec 19 '12 at 15:12
  • 1
    Let's say you do dc.Eval(webRequest.Parameters["p"]) - I can pass any column name into p and your code will give me the contents of that column. This is a bad idea, especially when doing JOINs onto user tables, because it essentially amounts to an SQL injection. – Polynomial Dec 19 '12 at 15:15
  • 1
    Absolutely not. Doing so would constitute a direct object reference bug. – Polynomial Dec 19 '12 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.