Skip to content

Commit abf94cf

Browse files
gewarrengewarren
authored
Clarify difference between violation/solution (#36329)
1 parent 18559e4 commit abf94cf

File tree

5 files changed

+135
-111
lines changed

5 files changed

+135
-111
lines changed

‎docs/fundamentals/code-analysis/quality-rules/ca3009.md‎

Lines changed: 30 additions & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: "CA3009: Review code for XML injection vulnerabilities (code analysis)"
33
description: "Learn about code analysis rule CA3009: Review code for XML injection vulnerabilities"
4-
ms.date: 07/21/2020
4+
ms.date: 07/19/2023
55
ms.topic: reference
66
author: dotpaul
77
ms.author: paulming
@@ -38,139 +38,58 @@ This rule attempts to find input from HTTP requests reaching a raw XML write.
3838
3939
## How to fix violations
4040

41-
Don't write raw XML. Instead, use methods or properties that XML-encode their input.
41+
To fix a violation, use one of the following techniques:
4242

43-
Or, XML-encode input before writing raw XML.
44-
45-
Or, validate user input by using sanitizers for primitive type conversion and XML encoding.
43+
- Don't write raw XML. Instead, use methods or properties that XML-encode their input.
44+
- XML-encode input before writing raw XML.
45+
- Validate user input by using sanitizers for primitive type conversion and XML encoding.
4646

4747
## When to suppress warnings
4848

4949
Don't suppress warnings from this rule.
5050

51-
## Configure code to analyze
52-
53-
Use the following options to configure which parts of your codebase to run this rule on.
54-
55-
- [Exclude specific symbols](#exclude-specific-symbols)
56-
- [Exclude specific types and their derived types](#exclude-specific-types-and-their-derived-types)
51+
## Pseudo-code examples
5752

58-
You can configure these options for just this rule, for all rules it applies to, or for all rules in this category ([Security](security-warnings.md)) that it applies to. For more information, see [Code quality rule configuration options](../code-quality-rule-options.md).
53+
### Violation
5954

60-
[!INCLUDE[excluded-symbol-names](../includes/excluded-symbol-names.md)]
55+
In this example, the input is set to the <xref:System.Xml.XmlElement.InnerXml> property of the root element. Given input that contains valid XML, a malicious user can then completely alter the document. Notice that `alice` is no longer an allowed user after the user input is added to the document.
6156

62-
[!INCLUDE[excluded-type-names-with-derived-types](../includes/excluded-type-names-with-derived-types.md)]
57+
:::code language="csharp" source="snippets/csharp/netfx/ca3009.cs" id="violation" highlight="12":::
6358

64-
## Pseudo-code examples
59+
:::code language="vb" source="snippets/vb/netfx/ca3009.vb" id="violation" highlight="11":::
6560

66-
### Violation
61+
If an attacker uses this for input: `some text<allowedUser>oscar</allowedUser>`, then the XML document will be:
6762

68-
```csharp
69-
using System;
70-
using System.Xml;
71-
72-
public partial class WebForm : System.Web.UI.Page
73-
{
74-
protected void Page_Load(object sender, EventArgs e)
75-
{
76-
string input = Request.Form["in"];
77-
XmlDocument d = new XmlDocument();
78-
XmlElement root = d.CreateElement("root");
79-
d.AppendChild(root);
80-
81-
XmlElement allowedUser = d.CreateElement("allowedUser");
82-
root.AppendChild(allowedUser);
83-
84-
allowedUser.InnerXml = "alice";
85-
86-
// If an attacker uses this for input:
87-
// some text<allowedUser>oscar</allowedUser>
88-
// Then the XML document will be:
89-
// <root>some text<allowedUser>oscar</allowedUser></root>
90-
root.InnerXml = input;
91-
}
92-
}
63+
```xml
64+
<root>some text<allowedUser>oscar</allowedUser>
65+
</root>
9366
```
9467

95-
```vb
96-
Imports System
97-
Imports System.Xml
68+
### Solution
9869

99-
Public Partial Class WebForm
100-
Inherits System.Web.UI.Page
70+
To fix this violation, set the input to the <xref:System.Xml.XmlElement.InnerText> property of the root element instead of the <xref:System.Xml.XmlElement.InnerXml> property.
10171

102-
Sub Page_Load(sender As Object, e As EventArgs)
103-
Dim input As String = Request.Form("in")
104-
Dim d As XmlDocument = New XmlDocument()
105-
Dim root As XmlElement = d.CreateElement("root")
106-
d.AppendChild(root)
72+
:::code language="csharp" source="snippets/csharp/netfx/ca3009.cs" id="fix" highlight="12":::
10773

108-
Dim allowedUser As XmlElement = d.CreateElement("allowedUser")
109-
root.AppendChild(allowedUser)
74+
:::code language="vb" source="snippets/vb/netfx/ca3009.vb" id="fix" highlight="11":::
11075

111-
allowedUser.InnerXml = "alice"
76+
If an attacker uses this for input: `some text<allowedUser>oscar</allowedUser>`, then the XML document will be:
11277

113-
' If an attacker uses this for input:
114-
' some text<allowedUser>oscar</allowedUser>
115-
' Then the XML document will be:
116-
' <root>some text<allowedUser>oscar</allowedUser></root>
117-
root.InnerXml = input
118-
End Sub
119-
End Class
78+
```xml
79+
<root>some text&lt;allowedUser&gt;oscar&lt;/allowedUser&gt;
80+
<allowedUser>alice</allowedUser>
81+
</root>
12082
```
12183

122-
### Solution
123-
124-
```csharp
125-
using System;
126-
using System.Xml;
127-
128-
public partial class WebForm : System.Web.UI.Page
129-
{
130-
protected void Page_Load(object sender, EventArgs e)
131-
{
132-
string input = Request.Form["in"];
133-
XmlDocument d = new XmlDocument();
134-
XmlElement root = d.CreateElement("root");
135-
d.AppendChild(root);
136-
137-
XmlElement allowedUser = d.CreateElement("allowedUser");
138-
root.AppendChild(allowedUser);
139-
140-
allowedUser.InnerText = "alice";
141-
142-
// If an attacker uses this for input:
143-
// some text<allowedUser>oscar</allowedUser>
144-
// Then the XML document will be:
145-
// <root>&lt;allowedUser&gt;oscar&lt;/allowedUser&gt;some text<allowedUser>alice</allowedUser></root>
146-
root.InnerText = input;
147-
}
148-
}
149-
```
150-
151-
```vb
152-
Imports System
153-
Imports System.Xml
84+
## Configure code to analyze
15485

155-
Public Partial Class WebForm
156-
Inherits System.Web.UI.Page
86+
Use the following options to configure which parts of your codebase to run this rule on.
15787

158-
Sub Page_Load(sender As Object, e As EventArgs)
159-
Dim input As String = Request.Form("in")
160-
Dim d As XmlDocument = New XmlDocument()
161-
Dim root As XmlElement = d.CreateElement("root")
162-
d.AppendChild(root)
88+
- [Exclude specific symbols](#exclude-specific-symbols)
89+
- [Exclude specific types and their derived types](#exclude-specific-types-and-their-derived-types)
16390

164-
Dim allowedUser As XmlElement = d.CreateElement("allowedUser")
165-
root.AppendChild(allowedUser)
91+
You can configure these options for just this rule, for all rules it applies to, or for all rules in this category ([Security](security-warnings.md)) that it applies to. For more information, see [Code quality rule configuration options](../code-quality-rule-options.md).
16692

167-
allowedUser.InnerText = "alice"
93+
[!INCLUDE[excluded-symbol-names](../includes/excluded-symbol-names.md)]
16894

169-
' If an attacker uses this for input:
170-
' some text<allowedUser>oscar</allowedUser>
171-
' Then the XML document will be:
172-
' <root>&lt;allowedUser&gt;oscar&lt;/allowedUser&gt;some text<allowedUser>alice</allowedUser></root>
173-
root.InnerText = input
174-
End Sub
175-
End Class
176-
```
95+
[!INCLUDE[excluded-type-names-with-derived-types](../includes/excluded-type-names-with-derived-types.md)]

‎docs/fundamentals/code-analysis/quality-rules/snippets/csharp/netfx/ca3009.cs‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
using System;
2+
using System.Xml;
3+
4+
public partial class WebForm1 : System.Web.UI.Page
5+
{
6+
// <violation>
7+
protected void Page_Load(object sender, EventArgs e)
8+
{
9+
XmlDocument d = new XmlDocument();
10+
XmlElement root = d.CreateElement("root");
11+
d.AppendChild(root);
12+
13+
XmlElement allowedUser = d.CreateElement("allowedUser");
14+
root.AppendChild(allowedUser);
15+
allowedUser.InnerXml = "alice";
16+
17+
string input = Request.Form["in"];
18+
root.InnerXml = input;
19+
}
20+
// </violation>
21+
}
22+
23+
public partial class WebForm2 : System.Web.UI.Page
24+
{
25+
// <fix>
26+
protected void Page_Load(object sender, EventArgs e)
27+
{
28+
XmlDocument d = new XmlDocument();
29+
XmlElement root = d.CreateElement("root");
30+
d.AppendChild(root);
31+
32+
XmlElement allowedUser = d.CreateElement("allowedUser");
33+
root.AppendChild(allowedUser);
34+
allowedUser.InnerText = "alice";
35+
36+
string input = Request.Form["in"];
37+
root.InnerText = input;
38+
}
39+
// </fix>
40+
}

‎docs/fundamentals/code-analysis/quality-rules/snippets/csharp/netfx/project.csproj‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Library</OutputType>
5+
<TargetFramework>net48</TargetFramework>
6+
</PropertyGroup>
7+
8+
<ItemGroup>
9+
<Reference Include="System.Web" />
10+
</ItemGroup>
11+
12+
</Project>

‎docs/fundamentals/code-analysis/quality-rules/snippets/vb/netfx/ca3009.vb‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
2+
Imports System
3+
Imports System.Xml
4+
5+
Public Partial Class WebForm1
6+
Inherits System.Web.UI.Page
7+
8+
' <violation>
9+
Sub Page_Load(sender As Object, e As EventArgs)
10+
Dim d As XmlDocument = New XmlDocument()
11+
Dim root As XmlElement = d.CreateElement("root")
12+
d.AppendChild(root)
13+
14+
Dim allowedUser As XmlElement = d.CreateElement("allowedUser")
15+
root.AppendChild(allowedUser)
16+
allowedUser.InnerXml = "alice"
17+
18+
Dim input As String = Request.Form("in")
19+
root.InnerXml = input
20+
End Sub
21+
' </violation>
22+
End Class
23+
24+
Public Partial Class WebForm2
25+
Inherits System.Web.UI.Page
26+
27+
' <fix>
28+
Sub Page_Load(sender As Object, e As EventArgs)
29+
Dim d As XmlDocument = New XmlDocument()
30+
Dim root As XmlElement = d.CreateElement("root")
31+
d.AppendChild(root)
32+
33+
Dim allowedUser As XmlElement = d.CreateElement("allowedUser")
34+
root.AppendChild(allowedUser)
35+
allowedUser.InnerText = "alice"
36+
37+
Dim input As String = Request.Form("in")
38+
root.InnerText = input
39+
End Sub
40+
' </fix>
41+
End Class

‎docs/fundamentals/code-analysis/quality-rules/snippets/vb/netfx/project.vbproj‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Library</OutputType>
5+
<TargetFramework>net48</TargetFramework>
6+
</PropertyGroup>
7+
8+
<ItemGroup>
9+
<Reference Include="System.Web" />
10+
</ItemGroup>
11+
12+
</Project>

0 commit comments

Comments
 (0)