Scribd
Upload
32 views

Lecture - 5 - Error Handling

This document discusses secure coding practices for handling errors in a sample application called ComApp. ComApp allows users to post comments online and displays the most recent ten comments. The document outlines ComApp's features in three phases, including allowing anonymous comments, user accounts, and moderated comments. It describes potential issues like empty, long, or malicious comments containing SQL injections. It recommends defining boundary conditions, stripping unsafe HTML, and handling errors by logging messages and displaying generic error responses to users without revealing details.

Uploaded by

gunarathneisuri11
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
32 views

Lecture - 5 - Error Handling

This document discusses secure coding practices for handling errors in a sample application called ComApp. ComApp allows users to post comments online and displays the most recent ten comments. The document outlines ComApp's features in three phases, including allowing anonymous comments, user accounts, and moderated comments. It describes potential issues like empty, long, or malicious comments containing SQL injections. It recommends defining boundary conditions, stripping unsafe HTML, and handling errors by logging messages and displaying generic error responses to users without revealing details.

Uploaded by

gunarathneisuri11
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 9

9/10/2023

Software Security

Secure Coding Practices for Error Handling

Hiruna De Alwis
1

A Sample Application: ComApp

● This application will allow


○ Visitors to enter comments on the web site
○ Display ten recent comments
○ Comments emailed to customer service address

1
9/10/2023

ComApp : List of features

● Phase I
○ Allow anonymous comments
○ Allow users to enter a name along with the comment, regardless of whether or not they
are logged in to an account
● Phase II
○ Allow users to create accounts. Once they have created an account, they can view and
modify their past comments
○ Allow users to upload a small image with their comment
● Phase III
○ Allow administrative users to view and delete user accounts and moderate comments
3

ComApp: Sample application

● Code and User interface

2
9/10/2023

ComApp

● What will happen, If we do these


○ Honest mistake as typing errors.
○ Boredom - lack of enthusiasm, lack of interest
○ The challenge of outsmarting you
○ Simple curiosity - strange think they can play with
○ Actual malicious intent

ComApp: Actual malicious intent

● If you found script kiddy or hacker he might try following:


○ ‘ – as an input
○ “ – as an input
● What hackers willing to expect ?
○ Not sanitized inputs
● What will be the next attempt ?
○ Injection attack

3
9/10/2023

Injection attack - SQL injection

this is great"); drop table USERS; --

● How is this execute in database?


○ SQL statements :
○ $sql='INSERT INTO usrcomments(comment) VALUES("'.$user_comment.'")';
○ $sql=’INSERT INTO usrcomments(comment) VALUES("this is great"); drop table USERS; --
")’;

ComApp: Issues

● Issues in development
○ Empty comments
○ Lengthy comments
○ Raw database errors
■ Attackers take advantages to know about your server environment
○ Able to Insert scripts and links
○ Customer dissatisfactions

4
9/10/2023

ComApp: Boundary Conditions

● Sample list of boundary conditions for anonymous comment

○ Blank input ○ Guest book spam

○ Control characters ○ Binary data

○ Non alphanumeric data ○ Alternate encoded data – ASCII, UTF-

○ Excessively long inputs 8, Octal ,etc.


○ SQL injection

Goals of the
boundary conditions
● Reject any input that seems suspicious
● Simply ignoring input that isn’t what you
expected, giving users an error message and
chance to try again

10

5
9/10/2023

An Error

● An action which is inaccurate or incorrect


● An error in software or hardware is called a
bug

11

Error-Handling Mechanism

● The philosophy of the error handling is :


○ Test all the inputs entered by users
○ Reject anything that doesn't appear to be legitimate
● To do this we have to define what we are expecting user inputs looks like
● Ex :
○ Alpha numeric with few specific punctuation marks
○ Less than the maximum number of characters
○ Allow /Deny script codes (HTML tags)

12

6
9/10/2023

Stripping HTML from User inputs

● If we decided not allowed HTML code insert through application, we can remove those from
the user inputs
● Are we going to reject entire message due to presence of HTML content?
○ It is your choice
● If not:
○ We can strip the HTML tags
○ strip_tags()
■ Function in php removes HTML tags and leaving only the raw data

13

Accepting HTML from safely

● If you decided to allow HTML tags in user inputs:


○ PHP provides two built in function to handle this problem
○ htmlentities()
■ Convert all applicable characters to HTML entities
○ htmlspecialchars()
■ Replace few common HTML tags with its equivalent character code
■ Ex :
● & &amp
● “ &quot
● ‘ &#039
14
● < &lt

7
9/10/2023

Spammers

● Spammers don’t use their accounts to send spam emails


● They try to send their spam emails through insecure web applications
● Viral email marketing
● How to prevent your application from this attack:
○ Don’t use email transport system in open web application unless absolutely need it
○ Discourage spammers

15

Erroneous data

● Display error message to user


● Write error message to log file depending on its severity
● Display formatted error message to users
● Don’t provide too much information about error and the security measures
○ Ex :
■ Sorry , Didn’t understand your comment. Please try it again

16

8
9/10/2023

Thanks!

Contact:

Hiruna De Alwis
hiruna@effectivesolutions.lk

17

You might also like