Denim Group, Ltd.

.NET Code for Setting IE Preferences

By Dan Cornell

GregL from Denim Group spent a bunch of time solving a .NET coding issue last week.  Since he couldn't find the information he needed with a simple Google query I figured I would put some of it up here hoping to help folks who had to solve the same problem in the future.

The situation was this: He had a WebBrowser control that we were using in a Windows Forms application to display web pages inside an application that was essentially a custom web browser.  On a new Windows XP installation, the first time you try to submit a form to access the Internet you get the annoying message:

When you send information to the internet, it might  be possible for others to see that information.  Do you want to  continue?

First of all this is a pretty pointless message.  But whatever...

The problem he ran into was that the pop up windows didn't appear when it was initiated by the WebBrowser control, causing the application to hang while waiting for a response.  To get around this he wanted to set the registry key related to this error message so the system treated it as if the message had already been accepted.

To find the correct registry key, he used RegMon from SysInternals to watch for keys being written.  He limited his search to keys off of "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Interent Settings"  He also limited the search to only look at keys associated with iexplorer.exe's registry activity and to highlight all SetValue calls.  There were still a HUGE number of entries because IE is very chatty with the registry...

The code to do this ought to look something like this:

RegistryKey key = Registry.CurrentUser.OpenSubKey("\\Software\\Microsoft\\Windows\\CurrentVersion\\Interent Settings\\Zones\\3",true);
if (key == null)
{
    key = Registry.CurrentUser.CreateSubKey("\\Software\\Microsoft\\Windows\\CurrentVersion\\Interent Settings\\Zones\\3");
}
key.SetValue("1601", 0);

Zone 3 is for the "Internet" zone.
1601 is the message key we are zeroing out.

So this was fun stuff.  Many thanks to GregL for all the detective work tracking this down.

--Dan
dan _at_ denimgroup.com

A Guide to ASP.NET’s Page Life Cycle and the ViewState

by Paul S.

ASP.NET provides you with several life-cycle events for you to handle and insert all the functionality of your web application.  This article will explore the operations that all web-pages need to do, and map them to the ASP.NET lifecycle events.  Then we will look at the tradeoffs you need to think about to maximize the efficiency of your pages and deal with the ViewState.

To Thine Own Self Be True

By Michael R.

While working on a .NET 2.0 web application, the team encountered a bug of a particularly maddening sort (often described as a Heisenbug).  The issue can be reproduced reliably, but only when the source is compiled and run in release mode. With debug-mode compilation, or stepping through a release-mode compile in Visual Studio, the code performs as expected.

Essentially, when the release-mode code executes outside of Visual Studio, requesting the index of a known item in a list returns -1, indicating no matching object was found in the list.  IndexOf uses equality between the argument and each object in the list to determine if item is in the list.  In this instance, the object is there, but the test for equality failed.

The details of using the debugger and the "Immediate window" to identify the culprit are fodder for future discussion.  The bug itself, which is recreated in the console application below, shows why it failed, along with a demonstration of the fix. Some readers may notice that several details of implementing the IComparable interface are missing, which were omitted for brevity. 

using System;

 

namespace FloatIssue

{

class Program

    {

static void Main(string[] args)

        {

MyFloat mf0 = new MyFloat(0f);

Console.WriteLine("MyFloat(0f).Equals(self)      : {0}", mf0.Equals(mf0));

 

MyFloat mf1 = new MyFloat(0.01f);

Console.WriteLine("MyFloat(0.01f).Equals(self)   : {0}", mf1.Equals(mf1));

 

Console.WriteLine("MyFloat(0f).EqualsFix(self)   : {0}", mf0.EqualsFix(mf0));

Console.WriteLine("MyFloat(0.01f).EqualsFix(self): {0}", mf1.EqualsFix(mf1));

        }

    }

 

class MyFloat

    {

private readonly float _DisplayValue;

 

public MyFloat(float pDisplayValue)

        {

            _DisplayValue = pDisplayValue;

        }

 

public float Value

        {

get

            {

return _DisplayValue / 100;

            }

        }

 

public float DisplayValue

        {

get

            {

return _DisplayValue;

            }

        }

 

public bool Equals(MyFloat pFloatBug)

        {

return (Value == pFloatBug.Value);

        }

 

public bool EqualsFix(MyFloat pFloatFix)

        {

return (DisplayValue == pFloatFix.DisplayValue);

        }

 

    }

} 

The value object class is a composition of several other value object classes, so its equality test depends on the equality tests for its members.  One member, which implements a percentage-weighted value, is represented by the MyFloat class.  The parameters of the constructor include a display value.  The display value is retrieved using the DisplayValue property, and the derived Value is calculated and returned by the getter each time the property is accessed.  The Equals method tests equality of the (derived) Value properties.

In debug mode, the output of the application is: 

MyFloat(0f).Equals(self)   : True

MyFloat(0.01f).Equals(self): True

MyFloat(0f).EqualsFix(self)   : True

MyFloat(0.01f).EqualsFix(self): True

 

However, in release mode, executed from the command line, the output is: 

MyFloat(0f).Equals(self)      : True

MyFloat(0.01f).Equals(self)   : False

MyFloat(0f).EqualsFix(self)   : True

MyFloat(0.01f).EqualsFix(self): True

A small change to the Equals method (shown as EqualsFix) to compare the readonly DisplayValue attribute rather than the derived-on-demand Value property causes the class to behave as expected in both modes.

—Michael R.

Mono 1.9

Last Friday the folks at the Mono Project released Mono 1.9. A list of the new features from its previous version can be found here.

I've watched the Mono project with great interest as they are the group furthest along in an open source version of the .NET platform. If you've ever wondered what a .NET application would look like on Linux or MacOS, then Mono should satisfy that curiosity. What makes this most current version so worthwhile is the inclusion of all the recent additions to the .NET framework. By default, the mono compiler can compile code written for the .NET 3.5 Framework (just released in November!), including such new features as LINQ and Silverlight. Virtually all of the .NET 3.0 foundation components are included as well, including those for web and presentation development. The project includes some fairly robust examples and documentation and an IDE called Monodevelop for more sophisticated development. And of course, if you don't like a certain implementation in Mono, because it is open source, you are free to make a change to the source code and submit it.

The Mono 1.9 SDK is freely available and can run on MacOS, Linux, and (amusingly) Windows operating systems. For web applications, plugins for different web servers exist, although Apache's is the furthest along and the built-in test server is very good for non-deployment purposes. Overall, this is a very good release over the previous and serves to whet the appetite for the much anticipated Mono 2.0.

—Erhan K.

Hello Secure World

Microsoft has just created a new security awareness site. This site, http://www.hellosecureworld.com, attempts to provide security awareness and education in the developer community.

The notion of security awareness is very interesting. Michael Howard, during his security development lifecycle presentation given at Denim Group, discussed some of the security classes he taught up in Redmond. These daylong classes were given to developers of different projects. The goal wasn't to make them security gurus or even to remember the difference between, say, symmetric- and asymmetric-key algorithms (if that doesn't take a security guru). The goals were to simply inform developers of common security scenarios and solutions. If they forgot the solutions the minute they left the class, that was OK, as long as that when presented with similar situations, they might recognize the scenario and perhaps Google for a solution (or, since this is Microsoft, perform a Live search).

And just as Microsoft competes with Google (and, at least for now, Yahoo!), Hello Secure World also requires Silverlight, Microsoft's answer to Adobe's Flash.

—Erhan K.

Free LINQ E-Book from MS Press

By Erhan

As mentioned previously, here at Denim Group we're really digging the new Language Integrated Query (LINQ)  technology Microsoft embedded in its latest version of the .NET Framework. There are plenty of tutorials around for it, but for those who like to dig deeper, MS Press has released a new E-Book on LINQ as well as sample chapters on its other new technologies, ASP.NET AJAX and Silverlight. The free download requires signing up for a monthly e-newsletter (so technically, not free), but for those unwilling to sign up, they show the first chapter for each book, which might be enough to get a feel for what LINQ can provide.

—Erhan K.

First Line of Defense for Web Applications - Series of Great MSDN Blog Posts

By Dan Cornell

There is a fantastic set of blog posts over on the Hackers blog on MSDN taking a deep look at input validation. Input validation is the most important thing you can do to make applications safer from malicious attackers.  If input validation is implemented well, you can even have glaring vulnerabilities in your application code but have the validation layer render them unexploitable or at least reduce the impact.  This isn't true all the time and input validation won't protect against many classes of attack, but starting with input validation as your foundation puts you in a position to avoid a lot of really silly, easy to find and exploit vulnerabilities.

The installments are:

• Part 1: Why Bother?
• Part 2: What Should You Validate?
• Part 3: Validation Strategies
• Part 4: Top Bloopers - Cross Site Scripting (XSS)
• Part 5: Top Bloopers - SQL Injection
• Conclusion: ASP.NET Platform Features

My favorite part about this series are the examples in parts 4 and 5.  They go through common, ineffective protection measures that teams implement and provide examples of attack payloads that circumvent these protections.  This is great information because a lot of development teams are using these ineffective protection mechanisms ("we replace every ' character with '' to prevent SQL injection...") and think that they are safe.  Having a set of clear and concise counter-examples is very useful in being able to see how applications remain exposed.

The series of articles also does a great job of demonstrating how black-list (negative) validation is a not-very-secure and ultimately brittle approach to validation.  They even provide an example of how the built-in ASP.NET Cross Site Scripting (XSS) protection (based on black-list validation) has been defeated in the past.

Even though there are a lot of ASP.NET specific examples, the principles covered in these posts apply to anyone developing applications deployed in a hostile environment - regardless of implementation platform.

--Dan
dan _at_ denimgroup.com

PS - I took the photo while riding ATVs on the beaches in Costa Rica last fall.

Bad Solutions to Important Problems

By Dan Cornell

The MSDN "Hackers" blog had a great post today about bad approaches to preventing Cross Site Scripting vulnerabilities.  When I am doing training classes for developers on software security I run into a lot of skepticism from time to time where developers don't want to fix problems because they think they are already protected because of goofy home-grown protective measures they have in place.  I have my standard set of examples that I like to run through of how to defeat black-list input validation and so on and this post is a great, structured example of more of the same.  It does a great job of stepping through some ineffective protective measure and potential exploits that work around the so-called protection.

This reminds me of some of the discussion in "Secure Programming with Static Analysis" where Brian Chess and Jacob West discourage software security personnel from focusing on exploitability.  They are right – spending a bunch of time to demonstrate how to get around each flawed protection mechanism is a waste of time that could be spent fixing issues and actually implementing proper protection.

--Dan

dan _at_ denimgroup.com

MSDN Magazine: Security Issue

By Dan Cornell

This month's MDSN Magazine issue is the annual Security issue.  There are some great articles in there on:

• Lessons learned from Trustworthy Computing
• Analyzing application crashes to find security vulnerabilities
• Reviewing code for security vulnerabilities
• Fuzzing

Check it out!

-Dan
dan _at_ denimgroup.com

Most Useful Link of the Week: 101 LINQ Samples

By Dan Cornell

I was talking to some of our folks in the office yesterday afternoon, and one of the guys pointed me to this page on MSDN that has 101 LINQ Samples.  If you are just getting started using LINQ this is a great way to jump start your learning curve.  At Denim Group we have been big Hibernate and NHibernate fans for quite some time, but LINQ is giving NHibernate a run for the money on some of our newer projects.  LINQ's integration with Visual Studio's Intellisense is a big plus.

(Thanks to Chris for the LINQ link and the LINQ walkthrough)

--Dan
dan _at_ denimgroup.com

Photo courtesy of Alan Weinkrantz.