Fortify Cross-site scripting: Persistent issue in Response.Binarywrite Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern) Data science time! April 2019 and salary with experience The Ask Question Wizard is Live!Determine file type of an imageTest image for upload with large file sizeFortify Cross Site Scripting: Poor ValidationCross-site scripting and ASP.NETFortify Cross Site Scripting in FileHp fortify issue- showing cross site scripting poor validation in PHPfortify cross site scriting on response.binarywriteHP Fortify Cross Site ScriptingCross-Site Scripting: Persistent issue while writing byte array to outputstreamXSS Cross Site Scripting Reflected in JavaScript fileFortify Fix High : Cross-Site Scripting Reflected

Multi tool use
Multi tool use

How to report t statistic from R

How would a mousetrap for use in space work?

Amount of permutations on an NxNxN Rubik's Cube

How does the math work when buying airline miles?

Did Mueller's report provide an evidentiary basis for the claim of Russian govt election interference via social media?

Trademark violation for app?

Is it possible for SQL statements to execute concurrently within a single session in SQL Server?

What does this say in Elvish?

How did Fremen produce and carry enough thumpers to use Sandworms as de facto Ubers?

Is there public access to the Meteor Crater in Arizona?

If Windows 7 doesn't support WSL, then what is "Subsystem for UNIX-based Applications"?

Karn the great creator - 'card from outside the game' in sealed

preposition before coffee

Did any compiler fully use 80-bit floating point?

Should a wizard buy fine inks every time he want to copy spells into his spellbook?

Drawing spherical mirrors

How can I prevent/balance waiting and turtling as a response to cooldown mechanics

Project Euler #1 in C++

Is there any word for a place full of confusion?

Why are vacuum tubes still used in amateur radios?

What does 丫 mean? 丫是什么意思?

Putting class ranking in CV, but against dept guidelines

What are the discoveries that have been possible with the rejection of positivism?

One-one communication



Fortify Cross-site scripting: Persistent issue in Response.Binarywrite



Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern)
Data science time! April 2019 and salary with experience
The Ask Question Wizard is Live!Determine file type of an imageTest image for upload with large file sizeFortify Cross Site Scripting: Poor ValidationCross-site scripting and ASP.NETFortify Cross Site Scripting in FileHp fortify issue- showing cross site scripting poor validation in PHPfortify cross site scriting on response.binarywriteHP Fortify Cross Site ScriptingCross-Site Scripting: Persistent issue while writing byte array to outputstreamXSS Cross Site Scripting Reflected in JavaScript fileFortify Fix High : Cross-Site Scripting Reflected



.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;








0















In an existing Asp.Net application, we are using Response.BinaryWrite to render image on an aspx page. This is the required functionality, and below is the C# code-



1. byte[] img = getImage();
2. Response.BinaryWrite(img);


The getImage function reads the image from a folder on server and returns byte array. Fortify scan shows cross-site vulnerability on 2nd line.



I did following validations, but fortify still reports it as cross-site issue -




  1. Validated bytearray to check if the file is of correct format (jpeg or bmp), used this link - Determine file type of an image



    Response.BinaryWrite(ValidateFileType(img));



  2. Validated the domain in the file path to check if the file is originating from correct domain.


Is there any specific way to pass the fortify cross-site issue with byte array or can i consider it as false positive?










share|improve this question






















  • If you do what you said, consider it as a False Positive. You follow the best practices

    – SPoint
    Apr 2 at 14:16

















0















In an existing Asp.Net application, we are using Response.BinaryWrite to render image on an aspx page. This is the required functionality, and below is the C# code-



1. byte[] img = getImage();
2. Response.BinaryWrite(img);


The getImage function reads the image from a folder on server and returns byte array. Fortify scan shows cross-site vulnerability on 2nd line.



I did following validations, but fortify still reports it as cross-site issue -




  1. Validated bytearray to check if the file is of correct format (jpeg or bmp), used this link - Determine file type of an image



    Response.BinaryWrite(ValidateFileType(img));



  2. Validated the domain in the file path to check if the file is originating from correct domain.


Is there any specific way to pass the fortify cross-site issue with byte array or can i consider it as false positive?










share|improve this question






















  • If you do what you said, consider it as a False Positive. You follow the best practices

    – SPoint
    Apr 2 at 14:16













0












0








0








In an existing Asp.Net application, we are using Response.BinaryWrite to render image on an aspx page. This is the required functionality, and below is the C# code-



1. byte[] img = getImage();
2. Response.BinaryWrite(img);


The getImage function reads the image from a folder on server and returns byte array. Fortify scan shows cross-site vulnerability on 2nd line.



I did following validations, but fortify still reports it as cross-site issue -




  1. Validated bytearray to check if the file is of correct format (jpeg or bmp), used this link - Determine file type of an image



    Response.BinaryWrite(ValidateFileType(img));



  2. Validated the domain in the file path to check if the file is originating from correct domain.


Is there any specific way to pass the fortify cross-site issue with byte array or can i consider it as false positive?










share|improve this question














In an existing Asp.Net application, we are using Response.BinaryWrite to render image on an aspx page. This is the required functionality, and below is the C# code-



1. byte[] img = getImage();
2. Response.BinaryWrite(img);


The getImage function reads the image from a folder on server and returns byte array. Fortify scan shows cross-site vulnerability on 2nd line.



I did following validations, but fortify still reports it as cross-site issue -




  1. Validated bytearray to check if the file is of correct format (jpeg or bmp), used this link - Determine file type of an image



    Response.BinaryWrite(ValidateFileType(img));



  2. Validated the domain in the file path to check if the file is originating from correct domain.


Is there any specific way to pass the fortify cross-site issue with byte array or can i consider it as false positive?







asp.net xss fortify cross-site






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Mar 22 at 11:00









Jitendra PanchalJitendra Panchal

3619




3619












  • If you do what you said, consider it as a False Positive. You follow the best practices

    – SPoint
    Apr 2 at 14:16

















  • If you do what you said, consider it as a False Positive. You follow the best practices

    – SPoint
    Apr 2 at 14:16
















If you do what you said, consider it as a False Positive. You follow the best practices

– SPoint
Apr 2 at 14:16





If you do what you said, consider it as a False Positive. You follow the best practices

– SPoint
Apr 2 at 14:16












1 Answer
1






active

oldest

votes


















0














Had to use a workaround to resolve this, below is the old and new code -



Old Code -



1. byte[] byteImage = getImage();
2. Response.BinaryWrite(byteImage);


New Code (Replaced 2nd line in old code with below block) -



byte[] byteImage = getImage();
var msIn = new MemoryStream(byteImage);
System.Drawing.Image img = System.Drawing.Image.FromStream(msIn);

var msOut = new MemoryStream();
img.Save(msOut, img.RawFormat);
Response.BinaryWrite(msOut.ToArray());

msIn.Dispose();
msOut.Dispose();
Response.Flush();


So, basically converting the byteArray to an Image object, and then writing the image object back to the Response.BinaryWrite stream resolved this, and it passed through Fortify scan.
If anyone is looking for a solution, this might help.






share|improve this answer























    Your Answer






    StackExchange.ifUsing("editor", function ()
    StackExchange.using("externalEditor", function ()
    StackExchange.using("snippets", function ()
    StackExchange.snippets.init();
    );
    );
    , "code-snippets");

    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "1"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader:
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    ,
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













    draft saved

    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55298187%2ffortify-cross-site-scripting-persistent-issue-in-response-binarywrite%23new-answer', 'question_page');

    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    0














    Had to use a workaround to resolve this, below is the old and new code -



    Old Code -



    1. byte[] byteImage = getImage();
    2. Response.BinaryWrite(byteImage);


    New Code (Replaced 2nd line in old code with below block) -



    byte[] byteImage = getImage();
    var msIn = new MemoryStream(byteImage);
    System.Drawing.Image img = System.Drawing.Image.FromStream(msIn);

    var msOut = new MemoryStream();
    img.Save(msOut, img.RawFormat);
    Response.BinaryWrite(msOut.ToArray());

    msIn.Dispose();
    msOut.Dispose();
    Response.Flush();


    So, basically converting the byteArray to an Image object, and then writing the image object back to the Response.BinaryWrite stream resolved this, and it passed through Fortify scan.
    If anyone is looking for a solution, this might help.






    share|improve this answer



























      0














      Had to use a workaround to resolve this, below is the old and new code -



      Old Code -



      1. byte[] byteImage = getImage();
      2. Response.BinaryWrite(byteImage);


      New Code (Replaced 2nd line in old code with below block) -



      byte[] byteImage = getImage();
      var msIn = new MemoryStream(byteImage);
      System.Drawing.Image img = System.Drawing.Image.FromStream(msIn);

      var msOut = new MemoryStream();
      img.Save(msOut, img.RawFormat);
      Response.BinaryWrite(msOut.ToArray());

      msIn.Dispose();
      msOut.Dispose();
      Response.Flush();


      So, basically converting the byteArray to an Image object, and then writing the image object back to the Response.BinaryWrite stream resolved this, and it passed through Fortify scan.
      If anyone is looking for a solution, this might help.






      share|improve this answer

























        0












        0








        0







        Had to use a workaround to resolve this, below is the old and new code -



        Old Code -



        1. byte[] byteImage = getImage();
        2. Response.BinaryWrite(byteImage);


        New Code (Replaced 2nd line in old code with below block) -



        byte[] byteImage = getImage();
        var msIn = new MemoryStream(byteImage);
        System.Drawing.Image img = System.Drawing.Image.FromStream(msIn);

        var msOut = new MemoryStream();
        img.Save(msOut, img.RawFormat);
        Response.BinaryWrite(msOut.ToArray());

        msIn.Dispose();
        msOut.Dispose();
        Response.Flush();


        So, basically converting the byteArray to an Image object, and then writing the image object back to the Response.BinaryWrite stream resolved this, and it passed through Fortify scan.
        If anyone is looking for a solution, this might help.






        share|improve this answer













        Had to use a workaround to resolve this, below is the old and new code -



        Old Code -



        1. byte[] byteImage = getImage();
        2. Response.BinaryWrite(byteImage);


        New Code (Replaced 2nd line in old code with below block) -



        byte[] byteImage = getImage();
        var msIn = new MemoryStream(byteImage);
        System.Drawing.Image img = System.Drawing.Image.FromStream(msIn);

        var msOut = new MemoryStream();
        img.Save(msOut, img.RawFormat);
        Response.BinaryWrite(msOut.ToArray());

        msIn.Dispose();
        msOut.Dispose();
        Response.Flush();


        So, basically converting the byteArray to an Image object, and then writing the image object back to the Response.BinaryWrite stream resolved this, and it passed through Fortify scan.
        If anyone is looking for a solution, this might help.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Apr 9 at 12:50









        Jitendra PanchalJitendra Panchal

        3619




        3619





























            draft saved

            draft discarded
















































            Thanks for contributing an answer to Stack Overflow!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid


            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.

            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55298187%2ffortify-cross-site-scripting-persistent-issue-in-response-binarywrite%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            AxR8O D3lSjCqsiEbM,KNtl7g71rDBRNV yaOp0 Bb1k,ePi1X47 AwOG1oo2KgUf7k nTmc6,kad9
            fyHutITIhCIu7pemnLlWGipLjw

            Popular posts from this blog

            Kamusi Yaliyomo Aina za kamusi | Muundo wa kamusi | Faida za kamusi | Dhima ya picha katika kamusi | Marejeo | Tazama pia | Viungo vya nje | UrambazajiKuhusu kamusiGo-SwahiliWiki-KamusiKamusi ya Kiswahili na Kiingerezakuihariri na kuongeza habari

            SQL error code 1064 with creating Laravel foreign keysForeign key constraints: When to use ON UPDATE and ON DELETEDropping column with foreign key Laravel error: General error: 1025 Error on renameLaravel SQL Can't create tableLaravel Migration foreign key errorLaravel php artisan migrate:refresh giving a syntax errorSQLSTATE[42S01]: Base table or view already exists or Base table or view already exists: 1050 Tableerror in migrating laravel file to xampp serverSyntax error or access violation: 1064:syntax to use near 'unsigned not null, modelName varchar(191) not null, title varchar(191) not nLaravel cannot create new table field in mysqlLaravel 5.7:Last migration creates table but is not registered in the migration table

            은진 송씨 목차 역사 본관 분파 인물 조선 왕실과의 인척 관계 집성촌 항렬자 인구 같이 보기 각주 둘러보기 메뉴은진 송씨세종실록 149권, 지리지 충청도 공주목 은진현