Exploitable C# Functions [closed]

Answer 1

IMO: The nr 1 exploitable functions, are innocent looking, but very dangerously when used without thought.

In ASP.Net Response.Write or the shortcut:

  <%= searchTermFromUser %>

In ADO.Net:

• The string + operator:
  var sql = "SELECT * FROM table WHERE name = '" + searchTermFromUser + "'"

Answer 2

Using any type of unsafe code can cause problems such as pointers. Microsoft provided a good article about unsafe code here: http://msdn.microsoft.com/en-us/library/aa288474(VS.71).aspx

Answer 3

I've seen code where the user could set the name and parameters for a function call in a database. The system would then execute the named function through Reflection without checking anything ...

Answer 4

Reflection.Emit and CodeDom

Edit:

Allowing plugins or third party libraries that uses threading can bring your whole application down unless you load those libraries/plugins in a separate appdomain.

Answer 5

Probably half the framework contains very scary functions. I myself think that File.WriteAllText() is very scary since it can overwrite any file the current user has access to.

A different approach to this question would be how you can manage security. The article at http://ondotnet.com/pub/a/dotnet/2003/02/18/permissions.html contains a basic description concerning the .NET security system, with the System.Security.Permissions namespace containing all permissions .NET makes available. You can also take a look at http://msdn.microsoft.com/en-us/library/5ba4k1c5.aspx for more information.

In short, .NET allows you to limit the permissions a process can have, for example denying methods that change data on disk. You can then check these permissions and act on whether the process has them or not.

Answer 6

even a simple string comparison can be an issue.

If an application makes a trust decision based on the results of this String.Compare operation, the result of that decision could be subverted by changing the CurrentCulture

Take a look at the example. Fairly easy to miss