Improvement for “Sharing Position with Friends” in MGE based Web GIS Application-优快云博客

本文讨论了如何通过验证URL参数来防止跨站脚本攻击，确保与朋友分享位置功能的安全性。介绍了在传递参数前进行有效性检查的具体实现。

We just taked about the MapGuide Security Hotfix yestoday, and let’s make some improments to make our “Sharing Position With Friends” more secure as well. To avoid cross site script attack, it would be more secure to valide the parameters before pass it into URL.

code goes below, please pay attention to the code marked as bold.

    protected void Page_Load(object sender, EventArgs e)
    {

        // default flexible weblayout
        string webLayout = @"Library://Samples/Sheboygan/FlexibleLayouts/Slate.ApplicationDefinition";
        string viewerPathSchema = @"http://localhost/mapguide/fusion/templates/mapguide/slate/index.html?ApplicationDefinition={1}&SESSION={0}";


        string defaultUser = "Administrator";
        string defaultPassword = "admin";

        Utility utility = new Utility();

        utility.InitializeWebTier(Request);

        MgUserInformation userInfo = new MgUserInformation(defaultUser, defaultPassword);
        MgSiteConnection siteConnection = new MgSiteConnection();
        siteConnection.Open(userInfo);
        MgSite site = siteConnection.GetSite();
        string sessionId = site.CreateSession();

        //store in session for further use
        Session["sessionId"] = sessionId;

        if (Request["X"] != null && Request["Y"] != null && Request["scale"] != null)
        {
            string centerX = Request["X"].ToString();
            string centerY = Request["Y"].ToString();
            string scale = Request["scale"].ToString();

            // validate the parameter to avoid XSS attack
            if (IsValid(centerX) && IsValid(centerY) && IsValid(scale))
            {
                //Generate the new weblayout resource identifier
                webLayout = utility.ChangeInitialViewInWebLayout(webLayout, sessionId, centerX, centerY, scale);
            }

        }

        string viewerPath = string.Format(viewerPathSchema, sessionId, Server.UrlEncode(webLayout));

        Response.Redirect(viewerPath);

    }

    //Only number is valid 
    private bool IsValid(string input)
    {
        return System.Text.RegularExpressions.Regex.IsMatch(input, @"^(-|\+)?\d+(\.\d+)?$");
    }