hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2355 from cldrn/AspNetMaxRequestLength

Browse Source 
CodeQL query to check for insecure MaxLengthRequest values in ASP.NET applications
This commit is contained in:
Tom Hvitved
2019-11-25 17:02:22 +01:00
committed by GitHub
parent d58a6b02bf 795959ef8d
commit fede9aed04
9 changed files with 100 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
csharp/ql/src/Security Features/CWE-016/ASPNetMaxRequestLength.qhelp Normal file
View File

@@ -0,0 +1,47 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>
The <code>maxRequestLength</code> attribute sets the limit for the input
stream buffering threshold in KB. Attackers can use large requests to cause
denial-of-service attacks.
</p>
</overview>
<recommendation>
<p>
The recommended value is 4096 KB but you should try setting it as
small as possible according to business requirements.
</p>
</recommendation>
<example>
<p>
The following example shows the <code>maxRequestLength</code>
attribute set to a high value (255 MB) in a <code>Web.config</code>
file for ASP.NET:
</p>
<sample src="Web.config.ASPNetMaxRequestLength.bad" />
<p>
Unless such a high value is strictly needed, it is better to set
the recommended value (4096 KB):
</p>
<sample src="Web.config.ASPNetMaxRequestLength.good" />
</example>
<references>
<li>
MSDN:
<a href="https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.httpruntimesection.maxrequestlength?view=netframework-4.8">HttpRuntimeSection.MaxRequestLength Property</a>.
</li>
</references>
</qhelp>

22
csharp/ql/src/Security Features/CWE-016/ASPNetMaxRequestLength.ql Normal file
View File

@@ -0,0 +1,22 @@
/**
* @name Large 'maxRequestLength' value
* @description Setting a large 'maxRequestLength' value may render a webpage vulnerable to
* denial-of-service attacks.
* @kind problem
* @problem.severity warning
* @id cs/web/large-max-request-length
* @tags security
* frameworks/asp.net
* external/cwe/cwe-16
*/
import csharp
import semmle.code.asp.WebConfig
from SystemWebXMLElement web, XMLAttribute maxReqLength
where
maxReqLength = web
.getAChild(any(string s | s.toLowerCase() = "httpruntime"))
.getAttribute(any(string s | s.toLowerCase() = "maxrequestlength")) and
maxReqLength.getValue().toInt() > 4096
select maxReqLength, "Large 'maxRequestLength' value (" + maxReqLength.getValue() + " KB)."

6
csharp/ql/src/Security Features/CWE-016/Web.config.ASPNetMaxRequestLength.bad Normal file
View File

@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<httpRuntime maxRequestLength="255000" />
</system.web>
</configuration>

6
csharp/ql/src/Security Features/CWE-016/Web.config.ASPNetMaxRequestLength.good Normal file
View File

@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<httpRuntime maxRequestLength="4096" />
</system.web>
</configuration>

5
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.cs Normal file
View File

@@ -0,0 +1,5 @@
// Dummy class for extraction purposes
public class ASPNetMaxRequestLengthDummyClass
{
}

1
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.expected Normal file
View File

@@ -0,0 +1 @@
| bad/Web.config:4:5:4:46 | maxRequestLength=262144 | Large 'maxRequestLength' value (262144 KB). |

1
csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength.qlref Normal file
View File

@@ -0,0 +1 @@
Security Features/CWE-016/ASPNetMaxRequestLength.ql

6
csharp/ql/test/query-tests/Security Features/CWE-016/Web.config Normal file
View File

@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<httpRuntime maxRequestLength="4096" />
</system.web>
</configuration>

6
csharp/ql/test/query-tests/Security Features/CWE-016/bad/Web.config Normal file
View File

@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<httpRuntime maxRequestLength="262144" />
</system.web>
</configuration>