Contents
V5630. OWASP. Possible cookie injection. Potentially tainted data is used to create a cookie.
The analyzer has detected that unverified external data is used to create a cookie object. If this data is compromised, it may cause a cookie injection.
The example:
public void ChangeCookie()
{
String cookieValue = Request.Form["userRole"];
Response.Cookies.Add(
new HttpCookie(WebLocalizationConfiguration.CookieName, cookieValue)
{
Expires = Clock.Now.AddYears(2),
Path = Request.ApplicationPath
}
);
....
}In this case, a new object of the HttpCookie class is added to HttpResponse and is initialized using the external data, Request.Form. Using data without any verification or validation can allow attackers to manipulate an application.
To protect code against cookie injections, ensure that any data used to initialize the HttpCookie object is validated.
The fixed code:
public void ChangeCookie()
{
String cultureValue = Request.Form["userRole"];
if (!Regex.IsMatch(cultureValue, DataValidationPattern))
return;
Response.Cookies.Add(
new HttpCookie(WebLocalizationConfiguration.CookieName, cultureValue)
{
Expires = Clock.Now.AddYears(2),
Path = Request.ApplicationPath
}
);
....
}Before initializing the HttpCookie object with potentially tainted data, execute a validation check via a regular expression.
This diagnostic is classified as:
Was this page helpful?
