HTTP参数污染攻击

Question

我开发了一个Web应用程序并部署到服务器中，我的安全团队提出了以下安全性再通问题。

反射HTML参数污染（HPP）是一种注入弱点漏洞，当攻击者可以注入分隔符并更改应用程序生成的URL参数时，就会发生此漏洞。攻击的后果取决于应用程序的功能，但可能包括访问和潜在利用不可控制的变量，执行其他攻击（如跨站请求伪造）或以非预期的方式更改应用程序行为。建议包括使用严格的验证输入，以确保服务器正确处理编码的参数分隔符“％26”，并在用户提供的内容包含在应用程序生成的链接或其他形式的输出中时使用URL编码。

任何人都可以了解如何防止asp.net中的HTML参数污染

这是网页中的脚本代码

<script type="text/javascript" language="javascript">

        document.onclick = doNavigationCheck ;  
        var srNumberFinal="";

        function OpenDetailsWindow(srNumber)
        {    
            window.open("xxx.aspx?SRNumber="+srNumber+ "","","minimize=no,maximize=no,scrollbars=yes,status=no,toolbar=no,menubar=no,location=no,width=800,directories=no,resizable=yes,titlebar=no");
        }

        function OpenPrintWindow()
        {
            var querystrActivityId = "<%=Request.QueryString["activityId"]%>";

            if(querystrActivityId != "")
            {
                var url = "abc.aspx?id=" + "<%=Request.QueryString["id"]%>" + "&activityId=" + querystrActivityId + "";
            }
            else
            {

                var hdrActivityId = document.getElementById('<%=uxHdnHdrActivityId.ClientID%>').value;
                var url = "PrintServiceRequestDetail.aspx?id=" + "<%=Request.QueryString["id"]%>" + "&activityId=" + hdrActivityId + "";
            }

            childWinReference=window.open(url, "ChildWin","minimize=yes,maximize=yes,scrollbars=yes,status=yes,toolbar=no,menubar=yes,location=no,directories=no,resizable=yes,copyhistory=no");
            childWinReference.focus();
        }

        function NavigateSRCopy(srNumber)
        {    
            srNumberFinal = srNumber;

            if (srNumber != "undefined" && srNumber != null && srNumber != "")
            {
                new Ajax.Request('<%= (Request.ApplicationPath != "/") ? Request.ApplicationPath : string.Empty %>/xxx/AutoCompleteService.asmx/CheckFormID'
                                        , { method: 'post', postBody: 'srNumber=' + srNumber, onComplete: SearchResponse });
            }
        }

        function SearchResponse(xmlResponse)
        {
            var xmlDoc;

            try //Internet Explorer
            {
                xmlDoc=new ActiveXObject("Microsoft.XMLDOM");
                xmlDoc.async="false";
                xmlDoc.loadXML(xmlResponse.responseText);
            }  
            catch(e)
            {
                try // Firefox, Mozilla, Opera, etc.
                {
                    parser=new DOMParser();
                    xmlDoc=parser.parseFromString(xmlResponse.responseText,"text/xml");
                }
                catch(e)
                {
                    alert(e.message);   
                    return;
                }
            }

            if(xmlDoc.getElementsByTagName("string")[0].childNodes[0] != null)
            {
                formID = xmlDoc.getElementsByTagName("string")[0].childNodes[0].nodeValue; 
            }
            else
            {
                formID = null;
            }

            if(formID != null && formID != "")
            {          
                window.location.href = '/CustomerSupportRequest/CreateServiceRequest.aspx?id=' + formID + '&TemplateSR=' + srNumberFinal + '&Frompage=CopySR';

                return true;
            }
            else
            {    
                alert("This Service Request cannot be copied because it meets at least one of these conditions: \t\t\n\n        * It was created prior to 10/15/2008 \n        * It was auto generated as part of the Report Requeue Process \n        * It was auto generated as part of the ERA Requeue Process \n        * It was not created online");
            }
        }

        function UpdateChildCases()
        {
            var modalPopup = $find('modalParentChildComments');
            modalPopup.show(); 
        }

        function HideParentChildPopup()
        {
            var modalPopup = $find('modalParentChildComments');
            modalPopup.hide(); 
            return false;
        }

        function HideErrorSRNumsPopup()
        {
            var modalPopup = $find('modalParentErrorSRNumDisplay');
            modalPopup.hide(); 
            return false;
        }

        function HideRetrySRNumsPopup()
        {
            var modalPopup = $find('modalRetrySRNumDisplay');
            modalPopup.hide(); 
            return false;
        }

        function RemoveParent_ChildFlag(type)
        {
            var childCases = document.getElementById("<%=uxHdnChildCases.ClientID %>");
            var msg = "";
            var btn;

            if(type == "Child")
            {
                if(childCases.value.indexOf(',') != -1)
                    msg = "Are you sure you want to remove the Child flag from this Service Request?";
                else   
                    msg = "This is the only child associated to the parent case.  Removing the child flag will also remove the parent flag from the associated case.  Choose OK to remove the flags, or Cancel to close this dialog";

                btn = document.getElementById('<%=uxRemoveChildFlag.ClientID%>');
            }   
            else
            {
                msg = "Removing the parent flag from this case will also remove the child flag from all associated cases.  Are you sure you want to remove the Parent flag from this Service Request?";
                btn = document.getElementById('<%=uxRemoveParentFlag.ClientID%>');
            }

            if(btn)
            {
                if(!confirm(msg))
                {
                    return false;   
                }
                else
                {
                    btn.click();
                }
            } 
        }

        function limitTextForParentChildComments() 
        {   
            var objLblCharCount = document.getElementById('uxLblPCCharCount');
            var objTxtComments = document.getElementById('<%=txtParentComment.ClientID%>');

            if (objTxtComments.value.length > 1500) 
            {
                objTxtComments.value = objTxtComments.value.substring(0, 1500);
            } 
            else 
            {
                objLblCharCount.innerHTML = 1500 - objTxtComments.value.length + " ";
            }

            setTimeout("limitTextForParentChildComments()",50);
        }

        function ValidateInputs()
        {
            var lblErrorMessage = document.getElementById('<%=lblCommentErrorTxt.ClientID%>');
            var objTxtComments = document.getElementById('<%=txtParentComment.ClientID%>');

            if(objTxtComments.value.trim() == "")
            {
                lblErrorMessage.style.display = "block";
                return false;
            }
        }

    </script>

Answer 1

根据OWASP Testing for HTTP Parameter pollution，ASP.NET不容易受HPP攻击，因为ASP.NET将返回所有出现的与逗号连接的查询字符串值（例如color=red&color=blue给出color=red,blue）

有关示例说明，请参阅here。

也就是说，您的代码似乎容易受到XSS的攻击：

var querystrActivityId = "<%=Request.QueryString["activityId"]%>";

如果查询字符串参数activityId="; alert('xss');"（当然是URL编码），则会在您的应用程序上触发一个警告框，因为此代码将在您的脚本标记中生成。

var querystrActivityId = ""; alert('xss');"";