This page is not yet available in Spanish. We are working on its translation. If you have any questions or feedback about our current translation project, feel free to reach out to us!
usingMicrosoft.AspNetCore.Mvc;usingMicrosoft.AspNetCore.Http;usingSystem.IO;usingSystem.Web;usingSystem.Text;namespaceControllers{publicclassVulnerableController:Controller{privatereadonlystring_rootPath;publicVulnerableController(stringrootPath){_rootPath=rootPath;} [HttpPost("/path-test")]publicIActionResultPost(){// Get parameter from cookiesstringparam="defaultValue";if(Request.Cookies!=null){foreach(varcookieinRequest.Cookies){if(cookie.Key.Equals("TestCookie")){param=HttpUtility.UrlDecode(cookie.Value,Encoding.UTF8);break;}}}// Vulnerable: User input directly in Path.CombinestringfileName=Path.Combine(_rootPath,"files",param);// Use the unsafe valueFileStreamfs=null;try{fs=newFileStream(fileName,FileMode.Open);// Read file...}catch(Exceptione){// Handle error...}finally{fs?.Close();}returnOk();}}}
Compliant Code Examples
usingMicrosoft.AspNetCore.Mvc;usingMicrosoft.AspNetCore.Http;usingSystem.IO;usingSystem.Web;usingSystem.Text;namespaceControllers{publicclassSafeController:Controller{ [HttpPost("/path-test")]publicIActionResultPost(){// Get parameter from cookiesstringparam="defaultValue";if(Request.Cookies!=null){foreach(varcookieinRequest.Cookies){if(cookie.Key.Equals("TestCookie")){param=HttpUtility.UrlDecode(cookie.Value,Encoding.UTF8);break;}}}// Safe: Uses ternary that always evaluates to a constantstringfilePath=(7*18)+106>200?"safe_constant_filename":param;// Use the safe valueFileStreamfs=null;try{stringfullPath=Constants.FILES_DIR+filePath;fs=newFileStream(fullPath,FileMode.Open);// Read file...}catch(Exceptione){// Handle error...}finally{fs?.Close();}returnOk();}}publicstaticclassConstants{publicstaticstringFILES_DIR="files/";}}
Integraciones sin problemas. Prueba Datadog Code Security
Datadog Code Security
Prueba esta regla y analiza tu código con Datadog Code Security
Cómo usar esta regla
1
2
rulesets:- csharp-security # Rules to enforce C# security.
Crea un static-analysis.datadog.yml con el contenido anterior en la raíz de tu repositorio
Utiliza nuestros complementos del IDE gratuitos o añade análisis de Code Security a tus pipelines de CI.