0

Have an aggravating problem here and any help would be great. Basically one of our clients beefed up their security and implemented OWASP (owasp.org). Now, some of our existing site functionality is returning a security violation on postback. I narrowed down one of the major issues to the Telerik RadTabStrip. Once a page containing a RadTabStrip strip posts back, the OWASP returns a security violation. Unfortunately, we don't have access to the logs and the client has given us a few snippets but they seem to be SQL Injection related and also pattern matching on the view state.

I then created a blank page with one RadTabStrip with 4 RadTab/RadPageViews, each containing a letter of the alphabet and one button that would post back. Upon clicking the button, the security violation threw. So I am about 99.99% positive it is returning a false-positive with something the RadTab is posting back. I then modified one of our existing pages to implement JQuery tabs instead of the RadTabs. This worked successfully, but the problem is this would be a somewhat lengthy overhaul and was hoping someone out there might have an idea for me. Now please note that the client refuses to make any exceptions in the OWASP security.

1 Answer 1

0

What do you mean by "OWASP"?

We have hundreds of projects. I am guessing that you mean ESAPI for .NET?

If they're not going to tune the configuration for ESAPI, it's highly likely the best way forward is to see if you can put a support call into Telerik and see if RadTabStrip can be modified to do it within the bounds of ESAPI.

Alternatively, can you cut-n-paste the exception in and see if we can work out what the control is doing and see if there's a tweak that might work?

thanks Andrew

(really slack) ESAPI for PHP lead, OWASP Developer Guide 2013 lead, OWASP Top 10 2007 lead and general agent of chaos

1
  • Thanks for the response. I'm waiting for a cut n paste of the exception, but they aren't being very helpful with us which is frustrating. This is all I have to go off of right now: Detects concatenated basic SQL injection and SQLLFI attempts. Rule 981247
    – hammer
    Jul 11, 2012 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.