[研究]Fortify SCA報告 SHA512 sha512 宣告有 Privacy Violation: Heap Inspection問題
2021-12-02
C# + ASP.NET + WebForm
SHA512 sha512 = new SHA512CryptoServiceProvider(); |
建立初始化向量 (IV) 或加密金鑰之後，透過在物件上執行 Clear() 或 Dispose(true) 來確保其已從記憶體清除是非常必要的。
補上 sha512.Dispose();
try
{
...
}
catch (Exception ex)
{
...
}
finally
{
sha512.Dispose();
} |
(完)
[研究][ASP.NET][WebForm][C#]Fortify SCA 的 Privacy Violation: Heap Inspection 問題處理
2021-11-25
Software Security | Privacy Violation: Heap Inspection
https://vulncat.fortify.com/zh-tw/detail?id=desc.dataflow.java.privacy_violation_heap_inspection
摘要：錯誤地處理機密資訊，導致洩漏使用者隱私資訊，且是不合法的行為。
建議：當安全性和隱私要求發生矛盾時，通常隱私應該放在較重要的位置。為要滿足此要求，並仍維持所需的安全資訊，應在退出程式前清除所有的隱私資料。
Micro Focus Fortify Static Code Analyzer 的參考範例
static void ManipulateSecureString()
{
// SecureString, with some data
SecureString ss = new SecureString();
ss.AppendChar('a');
ss.AppendChar('s');
ss.AppendChar('d');
ss.AppendChar('f');
// copy data as unicode character array to a buffer in unmanaged space
IntPtr ssAsIntPtr = Marshal.SecureStringToGlobalAllocUnicode(ss);
for (Int32 i = 0; i < ss.Length; i++)
{
// multiply 2 because Unicode chars are 2 bytes wide
Char ch = (Char)Marshal.ReadInt16(ssAsIntPtr, i * 2);
// do something with each char
}
// don't forget to free it at the end
Marshal.ZeroFreeGlobalAllocUnicode(ssAsIntPtr);
} |
敝人改寫為一個函數
public static string AntiPrivacyViolationHeapInspection(string sensitiveString)
{
SecureString ss = new SecureString();
string ss2 = "";
foreach (char c in string.Format("{0}", sensitiveString))
{
ss.AppendChar(c);
}
IntPtr ssAsIntPtr = Marshal.SecureStringToGlobalAllocUnicode(ss);
for (Int32 i = 0; i < ss.Length; i++)
{
// multiply 2 because Unicode chars are 2 bytes wide
Char ch = (Char)Marshal.ReadInt16(ssAsIntPtr, i * 2);
ss2 = ss2 + ch;
}
Marshal.ZeroFreeGlobalAllocUnicode(ssAsIntPtr);
return ss2;
} |
(完)
