5

My company requires our ASP.NET code to pass a Fortify 360 scan before releasing the code. We use AntiXSS everywhere to sanitize HTML output. We also validate input. Unfortunately, they recently changed the "template" Fortify was using and now it's flagging all our AntiXSS calls as "Poor Validation". These calls are doing things like AntiXSS.HTMLEncode(sEmailAddress).

Anyone know exactly what would satisfy Fortify? A lot of what it's flagging is output where the value comes from a database and never from a user at all, so if HTMLEncode isn't safe enough, we have no idea what is!

3
  • 6
    Oh dear, that's the problem with automated tools - false positives. I'd suggest logging a support ticket with Fortify - AntiXSS shouldn't be marked this way. I'm the AntiXSS owner right now, so if Fortify want someone to talk to then you can point them to me, bdorrans@thatbigborgdomainname :)
    – blowdart
    Commented Jul 15, 2010 at 14:45
  • We actually did that, they said AntiXSS wasn't good enough. We asked what is, and we're still waiting for an answer. I wanted to see how other people get around this BS.
    – fd_dev
    Commented Jul 15, 2010 at 14:57
  • Ha, nice. Thinking more about it though the wording is interesting, AntiXSS doesn't validate of course, it simply takes what you give it and encodes it. Perhaps it's expecting some validation before that point.
    – blowdart
    Commented Jul 15, 2010 at 16:16

3 Answers 3

8

I'm a member of Fortify's Security Research Group and I'm sorry for the confusion this issue has been causing you. We haven't done a very good job of presenting this type of issue. I think part of the problem is the category name -- we're not trying to say that there is anything wrong with the validation mechanism, just that we cannot tell if it is the appropriate validation for this situation.

In other words, we don't know what the right validation is for your particular context. For this reason, we do not recognize any HTML encoding functions as validating against XSS out of the box, even the ones in Microsoft's AntiXSS library.

As for what the right solution is, if you are using HtmlEncode to output a username to the body of an HTML page, your original code is fine. If the the encoded username is being used in a URL, it could be vulnerable to XSS. At Fortify, when we find similar issues in our own code, if the validation matches the context, we mark it "Not an Issue".

We are aware of the problems around these issues keep tweaking our rules to make them more precise and understandable. We release new rules every three months and expect to make a couple changes in upcoming releases. For Q4, we plan to split the issues into Inadequate Validation (for blacklisting encoding and other weak validation schemes) and Context Sensitive Validation (the type of issue you're seeing). Please let us know if we can help more.

(A link to an OWASP explanation of why HTML encoding doesn't solve all problems: http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#Why_Can.27t_I_Just_HTML_Entity_Encode_Untrusted_Data.3F)

3
  • 3
    I'm sorry, but this is just a perfect example of the problems with automated tools that use type of scanning engine. AntiXss IS the correct solution for ALL contexts, the OWASP article notwithstanding - it explicitly states that while HTML encoding is not sufficent, encoding according to the correct context is - and these are provided by AntiXss. The problem is that Fortify cannot detect the correct context, and as a result of that cant figure out which method to use (as you stated).
    – AviD
    Commented Nov 4, 2010 at 14:20
  • As such, using the correct encoding method is not even "Context Sensitive Validation", it shouldn't even be floated in the first place. Only when using the wrong method according to context should fit in that category.
    – AviD
    Commented Nov 4, 2010 at 14:21
  • "Not an Issue" is the exact thing I did, when I was using Fortify (and incidentally Microsoft's AntiXSS) at HP. And yeah, too much false positives as well, part of the automated tools trade.
    – gmaran23
    Commented Dec 22, 2013 at 15:03
4

fd_dev, I would add that you shouldn't focus on squeezing your code to fit through static analysis hoops. If you are qualified and confident that the finding doesn't apply, use the Fortify GUI tools to record a comment and suppress the issue.

If you are not sure, take a little screenshot and email it to Fortify Technical Support. They are well qualified to advise you on how to interpret your Fortify security findings.

blowdart is spot on. See http://www.schneier.com/blog/archives/2008/05/random_number_b.html for the worst case of what can happen if you chase static analysis results without understanding the purpose of the code and the reason/mechanics behind the finding. (In a word, you could make the code worse instead of better)-:

1

We've found a solution. Believe it or not, this causes Fortify360 to accept the code.

string sSafeVal = Regex.Replace(sValue, @"[\x00-\x1F\x7F]+", "");
Response.Write AntiXSS.HTMLEncode(sSafeVal);

So where AntiXSS.HTMLEncode alone fails, replacing non-printable characters works. Nevermind the fact that the HTMLEncode would do that anyways. I'm guessing they simply trigger off the Regex.Replace and I imagine any pattern would work.

1
  • Tried this one but it still does not work. It still flags my code as having Medium vulnerabilities (Cross-Site Scripting: Poor Validation). I've no idea on how to solve it.
    – rcs
    Commented Apr 23, 2019 at 6:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.