Skip to content

Commit 40ace47

Browse files
attilaantalattilaantal
committed
docs(grid): create Security article
1 parent 36a8c31 commit 40ace47

File tree

3 files changed

+213
-0
lines changed

3 files changed

+213
-0
lines changed

‎controls/grid/images/grid-security-display-html.png‎

14.9 KB
Loading

‎controls/grid/images/grid-security-encode-html.png‎

14.1 KB
Loading

‎controls/grid/security.md‎

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
---
2+
title: Security
3+
page_title: Security - RadGrid
4+
description: RadGrid Security
5+
slug: grid/security
6+
tags: security,xss,cross site scripting, sql injection
7+
published: True
8+
position: 3
9+
---
10+
11+
# RadGrid Security
12+
13+
This article addresses Security issues concerning the Telerik RadGrid.
14+
15+
## Cross-site Scripting (XSS)
16+
17+
Cross Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected in the web application and submitted to the server. If no validation or protective measures are undertaken, the injected script will be executed during displaying data by the Web UI Control such as the RadGrid. Subsequently, any sensitive information could be successfully hijacked to a location, known by the attacker.
18+
19+
These type of attacks are popular, therefore, this matter is a commonly discussed topic in various public articles. You can learn more about how to protect your applications against XSS attacks by following these materials:
20+
21+
- MSDN: [How To: Prevent Cross-Site Scripting in ASP.NET](https://msdn.microsoft.com/en-us/library/ff649310.aspx)
22+
- OWASP: [Cross-site Scripting (XSS)](https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29)
23+
- MDN: [Cross-site scripting](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting)
24+
25+
26+
**RadGrid** by default will display HTML content. For instance, if one of the Fields in the Data Source contain HTML code such as `<b>some text</b>`, this value will be displayed in bold, or `<font style="color: green">some text</font>` will be green when rendered on the page.
27+
28+
Or in case the data source content contains scripts such as `<script>function(){ alert("window.alert run from a script")}</script>`, they will be executed upon loading the page.
29+
30+
For Example assuming the following content
31+
- ShipName column has its values wrapped in `<h2>` elements e.g. `<h2>Name 1</h2>`
32+
- ShipCountry column has its values wrapped in `<font>` and `<b>` elements e.g. `<font style="color: green"><b>Country 1</b></font>`
33+
34+
>caption Outputs
35+
36+
![](images/grid-security-display-html.png)
37+
38+
In order to prevent displaying HTML code or executing scripts, the built-in columns expose a property called **HtmlEncode** (`default true`) that you can use to Enable/Disable encoding. By setting its value to **True** all HTML tags will be encoded to HTML entities.
39+
40+
>caption Example Column definition
41+
42+
````ASP.NET
43+
<telerik:GridBoundColumn DataField="ShipName" HeaderText="ShipName" HtmlEncode="true">
44+
</telerik:GridBoundColumn>
45+
<telerik:GridBoundColumn DataField="ShipCountry" HeaderText="ShipCountry" HtmlEncode="true">
46+
</telerik:GridBoundColumn>
47+
````
48+
49+
>caption Example Output
50+
51+
![](images/grid-security-encode-html.png)
52+
53+
>caption Encoding HTML inside GridTemplateColumn
54+
55+
````ASP.NET
56+
<telerik:GridTemplateColumn HeaderText="Template Column">
57+
<ItemTemplate>
58+
<%# EncodeValue(Eval("ShipName")) %>
59+
</ItemTemplate>
60+
</telerik:GridTemplateColumn>
61+
````
62+
63+
>caption C#/VB Function
64+
65+
````C#
66+
protected string EncodeValue(object value)
67+
{
68+
return HttpUtility.HtmlEncode(value.ToString());
69+
}
70+
````
71+
````VB
72+
Protected Function EncodeValue(ByVal value As Object) As String
73+
Return HttpUtility.HtmlEncode(value.ToString())
74+
End Function
75+
````
76+
77+
>important While the Grid is capable of encoding the content to HTML Entities, this functionality only adds an extra layer of security. It is the **Developer's responsibility to sanitize the user input and eliminate malicious code** before inserting the values into the database.
78+
79+
80+
## SQL Injection
81+
82+
*SQL injection* is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker)
83+
84+
>important **RadGrid** will only work with the datasource (e.g. DataSet, DataTable, Array, List, Entity Objects, SqlDataSource) provided by the Developer and **does not**/**cannot interact with the database directly**.
85+
>
86+
>important Upon filtering, sorting, paging, etc., the Grid uses the Data Set provided by the Developer to perform those actions.
87+
88+
[](https://docs.microsoft.com/en-us/archive/msdn-magazine/2004/september/data-security-stop-sql-injection-attacks-before-they-stop-you)
89+
90+
91+
If binding data using SqlDataSource, the Grid requests data from that data source control configured by the developer.
92+
93+
The Developer will associate the Grid with the SqlDataSource Control. Upon Editing/Inserting the Grid will send a collection of Key (FieldName) & Value (User input) pairs, and from that point the SqlDataSource will take care of the rest.
94+
95+
````ASP.NET
96+
<telerik:RadGrid ID="RadGrid1" runat="server" AllowPaging="True" Width="800px"
97+
AutoGenerateEditColumn="true"
98+
AutoGenerateDeleteColumn="true"
99+
DataSourceID="SqlDataSource1"
100+
AllowAutomaticInserts="true"
101+
AllowAutomaticUpdates="true"
102+
AllowAutomaticDeletes="true">
103+
</telerik:RadGrid>
104+
````
105+
106+
The SqlDataSource will use the collection of key/pair values sent by the Grid and Queries that database.
107+
108+
>important It is not mandatory, yet **Crucial** to Parameterize the Values. That is the way to protect the Database from SQL Injections.
109+
110+
>caption Example SqlDataSource with Parameters
111+
112+
````ASP.NET
113+
<asp:SqlDataSource ID="SqlDataSource1" runat="server"
114+
ConnectionString="<%$ ConnectionStrings:ConnectionString %>"
115+
InsertCommand="INSERT INTO [Orders] ([OrderDate], [Freight], [ShipName], [ShipCountry]) VALUES (@OrderDate, @Freight, @ShipName, @ShipCountry)"
116+
SelectCommand="SELECT [OrderID], [OrderDate], [Freight], [ShipName], [ShipCountry] FROM [Orders]"
117+
UpdateCommand="UPDATE [Orders] SET [OrderDate] = @OrderDate, [Freight] = @Freight, [ShipName] = @ShipName, [ShipCountry] = @ShipCountry WHERE [OrderID] = @OrderID"
118+
DeleteCommand="DELETE FROM [Orders] WHERE [OrderID] = @OrderID">
119+
<InsertParameters>
120+
<asp:Parameter Name="OrederID" DbType="Int32" />
121+
<asp:Parameter Name="OrderDate" DbType="DateTime" />
122+
<asp:Parameter Name="Freight" DbType="Decimal" />
123+
<asp:Parameter Name="ShipName" DbType="String" />
124+
<asp:Parameter Name="ShipCountry" DbType="String" />
125+
</InsertParameters>
126+
<UpdateParameters>
127+
<asp:Parameter Name="OrederID" DbType="Int32" />
128+
<asp:Parameter Name="OrderDate" DbType="DateTime" />
129+
<asp:Parameter Name="Freight" DbType="Decimal" />
130+
<asp:Parameter Name="ShipName" DbType="String" />
131+
<asp:Parameter Name="ShipCountry" DbType="String" />
132+
</UpdateParameters>
133+
<DeleteParameters>
134+
<asp:Parameter Name="OrederID" DbType="Int32" />
135+
</DeleteParameters>
136+
</asp:SqlDataSource>
137+
````
138+
139+
If binding data programmatically, the Grid will be assigned a Data Set provided by the developer.
140+
141+
````ASP.NET
142+
<telerik:RadGrid ID="RadGrid1" runat="server" AllowPaging="True" Width="800px" OnNeedDataSource="RadGrid1_NeedDataSource">
143+
</telerik:RadGrid>
144+
````
145+
146+
````C#
147+
protected void RadGrid1_NeedDataSource(object sender, GridNeedDataSourceEventArgs e)
148+
{
149+
var myDataSource = new DataTable();
150+
151+
// Developer's logic to QUERY the database e.g. "SELECT [Column] FROM [Table] WHERE [Column] = @someValue"
152+
// Developer's needs to make sure to parameterize the Query before fetching data from the SQL Server
153+
// Developer's logic to get the results in a Data Set such as DataTable, or List or a Business Object
154+
155+
// Example - Developer's Functions fetching data from the DataSource
156+
myDataSource = FetchData("SELECT [Column] FROM [Table] WHERE [Column] = @someValue");
157+
// Assing the results to RadGrid
158+
(sender as RadGrid).DataSource = myDataSource;
159+
}
160+
````
161+
````VB
162+
Protected Sub RadGrid1_NeedDataSource(ByVal sender As Object, ByVal e As GridNeedDataSourceEventArgs)
163+
Dim myDataSource = New DataTable()
164+
'Developer's logic to QUERY the database e.g. "SELECT [Column] FROM [Table] WHERE [Column] = @someValue"
165+
'Developer's needs to make sure to parameterize the Query before fetching data from the SQL Server
166+
'Developer's logic to save the results in a Table such as DataTable, or List or a Business Object
167+
'Developer's Functions fetching data from the DataSource
168+
myDataSource = FetchData("SELECT [Column] FROM [Table] WHERE [Column] = @someValue")
169+
'Assing the results to RadGrid
170+
(TryCast(sender, RadGrid)).DataSource = myDataSource
171+
End Sub
172+
````
173+
174+
## FAQ
175+
176+
### RadGrid is vulnerable to SQL Injection using StoredProcedures.
177+
178+
RadGrid does not/cannot have direct access to the database. Check out the [SQL Injection](#sql-injection) section.
179+
180+
To avoid SQL Injection, the developer must create parameters for StoredProcedures as well.
181+
182+
>caption Example Stored Procedure with Parameters
183+
184+
````SQL
185+
CREATE PROCEDURE SelectAllCustomers @City nvarchar(30), @PostalCode nvarchar(10)
186+
AS
187+
SELECT * FROM Customers WHERE City = @City AND PostalCode = @PostalCode
188+
GO;
189+
````
190+
191+
192+
### Vulnerability detected in RadGrid pagination
193+
194+
RadNumericTextBox in the Grid pager having reference to JavaScript [eval()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) function which is not recommended.
195+
196+
There is no reason to worry, the **RadNumericTextBox** Control does not allow any value set other than numbers (0-9).
197+
198+
Often when conducting a [Static Application Security](#what-are-static-and-dynamic-application-security-testing) Testing, results may contain *false positive* because it could detect a function or JS version known to be vulnerable, however, in practice that would not happen.
199+
200+
Furthermore, the embedded jQuery in the Telerik Assemblies has BackPorts to address the Vulnerabilities, see [Vulnerabilities of jQuery versions embedded in UI for ASP.NET AJAX]({%slug common-vulnerabilities-of-jquery-versions-embedded-in-ui-for-asp.net-ajax%}). This is the reason we recommend using the embedded jQuery rather than Including External (other versions).
201+
202+
203+
### What are Static and Dynamic Application Security Testing?
204+
205+
**Static Testing**
206+
207+
Static analysis is performed in a non-runtime environment. Static application security testing (SAST) is a testing process that looks at the application from the inside out. This test process is performed without executing the program, but rather by examining the source code, byte code or application binaries for signs of security vulnerabilities. In the static test process, the application data and control paths are modeled and then analyzed for security weaknesses. Static analysis is a test of the internal structure of the application, rather than functional testing.
208+
209+
**Dynamic Testing**
210+
211+
Dynamic analysis adopts the opposite approach and is executed while a program is in operation. Dynamic application security testing (DAST) looks at the application from the outside in — by examining it in its running state and trying to manipulate it in order to discover security vulnerabilities. The dynamic test simulates attacks against a web application and analyzes the application’s reactions, determining whether it is vulnerable.
212+
213+

0 commit comments

Comments
 (0)