HTTP 参数污染攻击

Question

我开发了一个 Web 应用程序并部署到服务器中，我的安全团队提出了以下安全补救问题。

反射 HTML 参数污染 (HPP) 是一种注入弱点漏洞，当攻击者可以注入分隔符并更改应用程序生成的 URL 的参数时，就会发生这种漏洞。攻击的后果取决于应用程序的功能，但可能包括访问和潜在地利用不可控变量、进行其他攻击（如跨站点请求伪造）或以非预期方式更改应用程序行为。建议包括使用严格的验证输入以确保服务器正确处理编码的参数分隔符“%26”，并在用户提供的内容包含在应用程序生成的链接或其他形式的输出中时使用 URL 编码。

谁能知道如何防止asp.net中的HTML参数污染

这是网页中的脚本代码

<script type="text/javascript" language="javascript">

        document.onclick = doNavigationCheck ;  
        var srNumberFinal="";

        function OpenDetailsWindow(srNumber)
        {    
            window.open("xxx.aspx?SRNumber="+srNumber+ "","","minimize=no,maximize=no,scrollbars=yes,status=no,toolbar=no,menubar=no,location=no,width=800,directories=no,resizable=yes,titlebar=no");
        }

        function OpenPrintWindow()
        {
            var querystrActivityId = "<%=Request.QueryString["activityId"]%>";

            if(querystrActivityId != "")
            {
                var url = "abc.aspx?id=" + "<%=Request.QueryString["id"]%>" + "&activityId=" + querystrActivityId + "";
            }
            else
            {

                var hdrActivityId = document.getElementById('<%=uxHdnHdrActivityId.ClientID%>').value;
                var url = "PrintServiceRequestDetail.aspx?id=" + "<%=Request.QueryString["id"]%>" + "&activityId=" + hdrActivityId + "";
            }

            childWinReference=window.open(url, "ChildWin","minimize=yes,maximize=yes,scrollbars=yes,status=yes,toolbar=no,menubar=yes,location=no,directories=no,resizable=yes,copyhistory=no");
            childWinReference.focus();
        }

        function NavigateSRCopy(srNumber)
        {    
            srNumberFinal = srNumber;

            if (srNumber != "undefined" && srNumber != null && srNumber != "")
            {
                new Ajax.Request('<%= (Request.ApplicationPath != "/") ? Request.ApplicationPath : string.Empty %>/xxx/AutoCompleteService.asmx/CheckFormID'
                                        , { method: 'post', postBody: 'srNumber=' + srNumber, onComplete: SearchResponse });
            }
        }

        function SearchResponse(xmlResponse)
        {
            var xmlDoc;

            try //Internet Explorer
            {
                xmlDoc=new ActiveXObject("Microsoft.XMLDOM");
                xmlDoc.async="false";
                xmlDoc.loadXML(xmlResponse.responseText);
            }  
            catch(e)
            {
                try // Firefox, Mozilla, Opera, etc.
                {
                    parser=new DOMParser();
                    xmlDoc=parser.parseFromString(xmlResponse.responseText,"text/xml");
                }
                catch(e)
                {
                    alert(e.message);   
                    return;
                }
            }

            if(xmlDoc.getElementsByTagName("string")[0].childNodes[0] != null)
            {
                formID = xmlDoc.getElementsByTagName("string")[0].childNodes[0].nodeValue; 
            }
            else
            {
                formID = null;
            }

            if(formID != null && formID != "")
            {          
                window.location.href = '/CustomerSupportRequest/CreateServiceRequest.aspx?id=' + formID + '&TemplateSR=' + srNumberFinal + '&Frompage=CopySR';

                return true;
            }
            else
            {    
                alert("This Service Request cannot be copied because it meets at least one of these conditions: \t\t\n\n        * It was created prior to 10/15/2008 \n        * It was auto generated as part of the Report Requeue Process \n        * It was auto generated as part of the ERA Requeue Process \n        * It was not created online");
            }
        }

        function UpdateChildCases()
        {
            var modalPopup = $find('modalParentChildComments');
            modalPopup.show(); 
        }

        function HideParentChildPopup()
        {
            var modalPopup = $find('modalParentChildComments');
            modalPopup.hide(); 
            return false;
        }

        function HideErrorSRNumsPopup()
        {
            var modalPopup = $find('modalParentErrorSRNumDisplay');
            modalPopup.hide(); 
            return false;
        }

        function HideRetrySRNumsPopup()
        {
            var modalPopup = $find('modalRetrySRNumDisplay');
            modalPopup.hide(); 
            return false;
        }

        function RemoveParent_ChildFlag(type)
        {
            var childCases = document.getElementById("<%=uxHdnChildCases.ClientID %>");
            var msg = "";
            var btn;

            if(type == "Child")
            {
                if(childCases.value.indexOf(',') != -1)
                    msg = "Are you sure you want to remove the Child flag from this Service Request?";
                else   
                    msg = "This is the only child associated to the parent case.  Removing the child flag will also remove the parent flag from the associated case.  Choose OK to remove the flags, or Cancel to close this dialog";

                btn = document.getElementById('<%=uxRemoveChildFlag.ClientID%>');
            }   
            else
            {
                msg = "Removing the parent flag from this case will also remove the child flag from all associated cases.  Are you sure you want to remove the Parent flag from this Service Request?";
                btn = document.getElementById('<%=uxRemoveParentFlag.ClientID%>');
            }

            if(btn)
            {
                if(!confirm(msg))
                {
                    return false;   
                }
                else
                {
                    btn.click();
                }
            } 
        }

        function limitTextForParentChildComments() 
        {   
            var objLblCharCount = document.getElementById('uxLblPCCharCount');
            var objTxtComments = document.getElementById('<%=txtParentComment.ClientID%>');

            if (objTxtComments.value.length > 1500) 
            {
                objTxtComments.value = objTxtComments.value.substring(0, 1500);
            } 
            else 
            {
                objLblCharCount.innerHTML = 1500 - objTxtComments.value.length + " ";
            }

            setTimeout("limitTextForParentChildComments()",50);
        }

        function ValidateInputs()
        {
            var lblErrorMessage = document.getElementById('<%=lblCommentErrorTxt.ClientID%>');
            var objTxtComments = document.getElementById('<%=txtParentComment.ClientID%>');

            if(objTxtComments.value.trim() == "")
            {
                lblErrorMessage.style.display = "block";
                return false;
            }
        }

    </script>

Answer 1

根据OWASP Testing for HTTP Parameter pollution，ASP.NET 不会受到 HPP 的攻击，因为 ASP.NET 将返回所有出现的以逗号连接的查询字符串值（例如，color=red&color=blue 给出 color=red,blue）。

有关示例说明，请参阅here。

也就是说，您的代码似乎容易受到XSS 的攻击：

var querystrActivityId = "<%=Request.QueryString["activityId"]%>";

如果查询字符串参数activityId="; alert('xss');"（当然是 URL 编码），那么会在您的应用程序上触发一个警告框，因为此代码将在您的脚本标记中生成。

var querystrActivityId = ""; alert('xss');"";