Diff: tools/VisualCodeGrepper-2.1.0/vbfunctions.conf

Revision:

1:efe9cad8942f

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/tools/VisualCodeGrepper-2.1.0/vbfunctions.conf	Tue Mar 13 14:52:59 2018 +0300
@@ -0,0 +1,30 @@
+// Functions known to cause issues in VB/ASP code.
+// To add new issues use the format: function name[=>][[N]][description]
+//	(where N is a severity rating of 1 (Critical) to 3 (Medium) (or optionally, 0 for 'normal'))
+//
+// NB - function names are case-sensitive for this file
+//
+// MS banned functions
+CopyMemory=>This is a Microsoft Security Development Lifecycle (SDL) banned function and its use should be avoided if possible. Use memcpy_s in place of CopyMemory. Ensure source buffer is at least as big as the amount of data to be copied.
+RtlCopyMemory=>This is a Microsoft Security Development Lifecycle (SDL) banned function and its use should be avoided if possible. Use memcpy_s in place of RtlCopyMemory. Ensure source buffer is at least as big as the amount of data to be copied.
+
+// User environment
+GetTempPath=>This function obtains a path from user environment variables and may provide a different path from the expected path. As the path returned can also be written to and read from by other applications, any DLLs or input files obtained from this location could potentially be compromised.
+
+// Input validation
+<%@ Page validateRequest="false" %>=>[2]The application appears to deliberately de-activate the default .NET input validation functionality.
+LoadXml=>Potentially vulnerable to XXE DoS - MS suggests a workaround here: http://blogs.msdn.com/b/tomholl/archive/2009/05/21/protecting-against-xml-entity-expansion-attacks.aspx
+
+// Insecure Cryptography
+X509CertificateValidationMode.None=>[3]The code uses an insecure certificate validation mode.
+xor=>The application makes use of 'xor'. Check that it is not being used for obfuscation purposes as this can be trivially reversed.
+"SHA1"=>[3]The code appears to use the SHA-1 algorithm. This is no longer considered secure and a safe alternative should be used instead.
+CipherMode.ECB=>[3]The code appears to use the Electronic Code Book cipher mode. This does not obscure patterns in the input data and should not be used for encrypting patterned data such as English text, or most data files.
+"MD5"=>[3]The code appears to use the MD5 algorithm. This is no longer considered secure and a safe alternative should be used instead.
+
+// Test functionality
+helloworld=>The codebase appears to contain test functionality which may be abused by an attacker. Carry out a manual check to determine whether the codepath is executable.
+HelloWorld=>The codebase appears to contain test functionality which may be abused by an attacker. Carry out a manual check to determine whether the codepath is executable.
+
+//Error Handling
+On Error Resume Next=>[3]The code contains a directive to ignore errors which can result in unpredictable outcomes during execution and may lead to issues whereby an attack becomes possible because execution continues in unusual or undesirable circumstances.