Need help in filtering out some vulnerablity causing characters in querystring

Question

I need to filter out characters like /?-^%{}[];$=*`#|&@'\"<>()+,\. I need replace this with empty string if it is there in the query string. Please help me out. I am using this in ASP pages.

Answer 1

Where do you need to filter these values from? The url path or the query string? Where are you doing the filtering? In javascript, in vb or somewhere else (i.e. do you have access to the .NET framework?) When you say ASP pages do you mean ASP or ASP.NET?

Answer 2

Best idea would be to use a function something along the lines of:

Public Function MakeSQLSafe(ByVal sql As String) As String
    'first i'd avoid putting quote chars in as they might be valid? just double them up.
    Dim strIllegalChars As String = "/?-^%{}[];$=*`#|&@\<>()+,\"
    'replace single quotes with double so they don't cause escape character
    If sql.Contains("'") Then
        sql = sql.Replace("'", "''")
    End If
    'need to double up double quotes from what I remember to get them through
    If sql.Contains("""") Then
        sql = sql.Replace("""", """""")
    End If
    'remove illegal chars
    For Each c As Char In strIllegalChars
        If sql.Contains(c.ToString) Then
            sql = sql.Replace(c.ToString, "")
        End If
    Next

    Return sql
End Function

This hasn't been tested and it could probably be made more efficient, but it should get you going. Wherever you execute your sql in your app, just wrap the sql in this function to clean the string before execution:

ExecuteSQL(MakeSQLSafe(strSQL))

Hope that helps

Answer 3

As with any string sanitisation, you're much better off working with a whitelist that dictates which characters are allowed, rather than a blacklist of characters that aren't.

This question about filtering HTML tags resulted in an accepted answer suggesting the use of a regular expression to match against a whitelist: http://stackoverflow.com/questions/307013/how-do-i-filter-all-html-tags-except-a-certain-whitelist - I suggest you do something very similar.

Answer 4

I'm using URL Routing and I found this works well, pass each part of your URL to this function. It's more than you need as it converts characters like "&" to "and", but you can modify it to suit:

public static string CleanUrl(this string urlpart) {

    // convert accented characters to regular ones
    string cleaned = urlpart.Trim().anglicized();

    // do some pretty conversions
    cleaned = Regex.Replace(cleaned, " ", "-");
    cleaned = Regex.Replace(cleaned, "#", "no.");
    cleaned = Regex.Replace(cleaned, "&", "and");
    cleaned = Regex.Replace(cleaned, "%", "percent");
    cleaned = Regex.Replace(cleaned, "@", "at");

    // strip all illegal characters like punctuation
    cleaned = Regex.Replace(cleaned, "[^A-Za-z0-9- ]", "");

    // convert spaces to dashes
    cleaned = Regex.Replace(cleaned, " +", "-");

    // If we're left with nothing after everything is stripped and cleaned
    if (cleaned.Length == 0)
        cleaned = "no-description";

    // return lowercased string
    return cleaned.ToLower();
}

// Convert accented characters to standardized ones
private static string anglicized(this string urlpart) {
    string beforeConversion = "àÀâÂäÄáÁéÉèÈêÊëËìÌîÎïÏòÒôÔöÖùÙûÛüÜçÇ’ñ";
    string afterConversion = "aAaAaAaAeEeEeEeEiIiIiIoOoOoOuUuUuUcC'n";

    string cleaned = urlpart;

    for (int i = 0; i < beforeConversion.Length; i++) {
         cleaned = Regex.Replace(urlpart, afterConversion[i].ToString(), afterConversion[i].ToString());
    }
    return cleaned;

    // Spanish : ÁÉÍÑÓÚÜ¡¿áéíñóúü"

}