- However, it is notoriously error-prone to treat the URL as - a string and check if one of the allowed hosts is a substring of the - URL. Malicious URLs can bypass such security checks by embedding one + However, treating the URL as a string and checking if one of the + allowed hosts is a substring of the URL is very prone to errors. + Malicious URLs can bypass such security checks by embedding one of the allowed hosts in an unexpected location.
diff --git a/python/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp b/python/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp new file mode 100644 index 000000000000..b542ae252eb1 --- /dev/null +++ b/python/ql/src/Security/CWE-020/IncompleteHostnameRegExp.qhelp @@ -0,0 +1,69 @@ + ++ + Sanitizing untrusted URLs is an important technique for + preventing attacks such as request forgeries and malicious + redirections. Often, this is done by checking that the host of a URL + is in a set of allowed hosts. + +
+ +
+
+ If a regular expression implements such a check, it is
+ easy to accidentally make the check too permissive by not escaping the
+ . meta-characters appropriately.
+
+ Even if the check is not used in a security-critical
+ context, the incomplete check may still cause undesirable behaviors
+ when it accidentally succeeds.
+
+
+
+ Escape all meta-characters appropriately when constructing
+ regular expressions for security checks, pay special attention to the
+ . meta-character.
+
+
+
+ The following example code checks that a URL redirection
+ will reach the example.com domain, or one of its
+ subdomains.
+
+
+ The unsafe check is easy to bypass because the unescaped
+ . allows for any character before
+ example.com, effectively allowing the redirect to go to
+ an attacker-controlled domain such as wwwXexample.com.
+
+
+ The safe check closes this vulnerability by escaping the .
+ so that URLs of the form wwwXexample.com are rejected.
+
+ + Sanitizing untrusted URLs is an important technique for + preventing attacks such as request forgeries and malicious + redirections. Usually, this is done by checking that the host of a URL + is in a set of allowed hosts. + +
+ ++ However, treating the URL as a string and checking if one of the + allowed hosts is a substring of the URL is very prone to errors. + Malicious URLs can bypass such security checks by embedding one + of the allowed hosts in an unexpected location. + +
+ ++ + Even if the substring check is not used in a + security-critical context, the incomplete check may still cause + undesirable behaviors when the check succeeds accidentally. + +
++ + Parse a URL before performing a check on its host value, + and ensure that the check handles arbitrary subdomain sequences + correctly. + +
+
+
+ The following example code checks that a URL redirection
+ will reach the example.com domain.
+
+
+
+ The first two examples show unsafe checks that are easily bypassed.
+ In unsafe1 the attacker can simply add
+ example.com anywhere in the url. For example,
+ http://evil-example.net/example.com.
+
+ In unsafe2 the attacker must use a hostname ending in
+ example.com, but that is easy to do. For example,
+ http://benign-looking-prefix-example.com.
+
+
+
+ The second two examples show safe checks.
+ In safe1, a white-list is used. Although fairly inflexible,
+ this is easy to get right and is most likely to be safe.
+
+ In safe2, urlparse is used to parse the URL,
+ then the hostname is checked to make sure it ends with .example.com.
+