Scribd
Upload
26 views

Web Security Programming I

This document discusses building security into web applications from the start. It uses a simple Java-based web server code example to illustrate vulnerabilities that can arise if security is not considered during design. The example server is vulnerable to denial of service attacks from malformed requests. The document suggests improvements like validating requests and carefully handling exceptions to prevent information leaks and failures from unexpected input. Effective exception handling is key to designing securely.

Uploaded by

swami123456
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
26 views

Web Security Programming I

This document discusses building security into web applications from the start. It uses a simple Java-based web server code example to illustrate vulnerabilities that can arise if security is not considered during design. The example server is vulnerable to denial of service attacks from malformed requests. The document suggests improvements like validating requests and carefully handling exceptions to prevent information leaks and failures from unexpected input. Effective exception handling is key to designing securely.

Uploaded by

swami123456
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 25

Web Security Programming I

Building Security in from the Start

Except where otherwise noted all portions of this work are Copyright (c) 2007 Google
and are licensed under the Creative Commons Attribution 3.0 License
http://creativecommons.org/licenses/by/3.0/
A Simple Web Server
To illustrate what can go wrong if we do not
design for security in our web applications from
the start, consider a simple web server
implemented in Java.

All this program does is serve documents using


HTTP.

We will walkthrough the code in the following


slides.
Some Preliminaries…
• (HyperText Transfer Protocol): The
communications protocol used to connect to
servers on the Web.
• Its primary function is to establish a connection
with a Web server and transmit HTML pages to
the client browser or any other files required by
an HTTP application.
• Addresses of Web sites begin with an http://
prefix.
Some Preliminaries…
• A typical HTTP request that a browser makes to
a web server:
Get / HTTP/1.0
• When the server receives this request for
filename / (which means the root document on
the web server), it attempts to load index.html. It
sends back:
HTTP/1.0 200 OK
followed by the document contents.
SimpleWebServer: main()
/* This method is called when the program is run from
the command line. */

public static void main (String argv[]) throws Exception


{
/* Create a SimpleWebServer object, and run it */
SimpleWebServer sws = new SimpleWebServer();
sws.run();
}
SimpleWebServer Object
public class SimpleWebServer {

/* Run the HTTP server on this TCP port. */


private static final int PORT = 8080;

/* The socket used to process incoming connections


from web clients */
private static ServerSocket dServerSocket;

public SimpleWebServer () throws Exception {


dServerSocket = new ServerSocket (PORT);
}

public void run() throws Exception {


while (true) {
/* wait for a connection from a client */
Socket s = dServerSocket.accept();

/* then process the client's request */


processRequest(s);
}
}
SimpleWebServer: processRequest
1
/* Reads the HTTP request from the client, and
responds with the file the user requested or
a HTTP error code. */

public void processRequest(Socket s) throws Exception {

/* used to read data from the client */


BufferedReader br =
new BufferedReader (new InputStreamReader (s.getInputStream()));

/* used to write data to the client */


OutputStreamWriter osw =
new OutputStreamWriter (s.getOutputStream());

/* read the HTTP request from the client */


String request = br.readLine();

String command = null;


String pathname = null;
SimpleWebServer: processRequest
2
/* parse the HTTP request */
StringTokenizer st =
new StringTokenizer (request, " ");

command = st.nextToken();
pathname = st.nextToken();

if (command.equals("GET")) {
/* if the request is a GET
try to respond with the file
the user is requesting */
serveFile (osw,pathname);
}
else {
/* if the request is a NOT a GET,
return an error saying this server
does not implement the requested command */
osw.write ("HTTP/1.0 501 Not Implemented\n\n");
}

/* close the connection to the client */


osw.close();
SimpleWebServer:
serveFile 1
public void serveFile (OutputStreamWriter osw,
String pathname) throws Exception {
FileReader fr=null;
int c=-1;
StringBuffer sb = new StringBuffer();

/* remove the initial slash at the beginning


of the pathname in the request */
if (pathname.charAt(0)=='/')
pathname=pathname.substring(1);

/* if there was no filename specified by the


client, serve the "index.html" file */
if (pathname.equals(""))
pathname="index.html";
SimpleWebServer:
serveFile 2

/* try to open file specified by pathname */


try {
fr = new FileReader (pathname);
c = fr.read();
}
catch (Exception e) {
/* if the file is not found,return the
appropriate HTTP response code */
osw.write ("HTTP/1.0 404 Not Found\n\n");

return;
}
SimpleWebServer:
serveFile 3
/* if the requested file can be
successfully opened and read, then
return an OK response code and send
the contents of the file */
osw.write ("HTTP/1.0 200 OK\n\n");

while (c != -1) {
sb.append((char)c);

c = fr.read();

}
Can you identify any security vulnerabilities
in SimpleWebServer?
What Can Go Wrong?

Denial of Service (DoS):


• An attacker makes a web server
unavailable.
• Example: an online bookstore’s web
server crashes and the bookstore loses
revenue
DoS on SimpleWebServer?

Just send a carriage return as the first


message instead of a properly
formatted GET message…
DoS on SimpleWebServer?
processRequest():

/* read the HTTP request from the client */


String request = br.readLine();

String command = null;


String pathname = null;

/* parse the HTTP request */


StringTokenizer st =
new StringTokenizer (request, " ");

command = st.nextToken();
pathname = st.nextToken();
DoS on SimpleWebServer?

• The web server crashes


• Service to all subsequent clients is denied
until the web server is restarted
How Do We Fix This?

• The web server should immediately


disconnect from any web client that sends
a malformed HTTP request to the server.
• The programmer needs to carefully handle
exceptions to deal with malformed
requests.
How would you fix this code?
processRequest():

/* read the HTTP request from the client */


String request = br.readLine();

String command = null;


String pathname = null;

/* parse the HTTP request */


StringTokenizer st =
new StringTokenizer (request, " ");

command = st.nextToken();
pathname = st.nextToken();
A possible solution
/* read the HTTP request from the client */
String request = br.readLine();
String command = null;
String pathname = null;

try {
/* parse the HTTP request */
StringTokenizer st =
new StringTokenizer (request, " ");
command = st.nextToken();
pathname = st.nextToken();
} catch (Exception e) {
osw.write (“HTTP/1.0 400 Bad Request\n\n”);
osw.close();
return;
}
Importance of “Careful”
Exception Handling

• Error messages and observable behavior


can tip off an attacker to vulnerabilities
• Fault Injection: Providing a program with
input that it does not expect (as in the CR
for SimpleWebServer) and observing
behavior
Careful Exception Handling
• Two possible designs for
int checkPassword (String username, String password)

• The function could fail, so what exception should the function


return?

1) ERROR_ACCESS_DENIED
ERROR_PASS_FILE_NOT_FOUND
ERROR_OUT_OF_MEMORY
NO_ERROR_ACCESS_ALLOWED

2) NO_ERROR
ERROR
int getError ()

Be careful to not provide more information to a user than is needed.


Careful Exception Handling
int result = checkPassword ( … )
if (result == ERROR_ACCESS_DENIED) {
abort();
}
else {
// Complete login
}
• Problem: result != ERROR_ACCESS_DENIED
does not infer ERROR_ACCESS_ALLOWED
• Result could have been:
ERROR_PASS_FILE_NOT_FOUND or
ERROR_OUT_OF_MEMORY !
Fail-Safe
int result = checkPassword ( … )
if (result == NO_ERROR) {
// Complete login
}
else {
int reason = getError();
abort();
}
• Much better– less error prone!
• checkPassword failure occurs securely!
Summary

• Effective exception handling is essential in


designing security in from the start

• Next time, we look at other vulnerabilities


in the SimpleWebServer
Sources
• The content of these slides was adapted
from:

• "Foundations of Security: What Every Programmer


Needs To Know" (ISBN 1590597842) by Neil Daswani,
Christoph Kern, and Anita Kesavan.

• http://www.learnsecurity.com/ntk

You might also like