Security: Handle ASP.NET Colors with Care
As Nikhil reports, .NET colors used in the context of ASP.NET applications can become so dangerous to lead you straight to a cross-site script attack. Of course, this can't happen if you use colors through RGB triplets. However, from within ASP.NET pages and controls it is fairly common to manage colors through their HTML representation--actually, a string. Surprisingly, assigning color properties with unfiltered HTML color strings can be as dangerous as outputting unfiltered text to the page. Here's an example (taken from Nikhil's post)
<asp:TextBox runat="server" id="colorTextBox" />
<asp:Panel runat="server" id="colorPanel" />
<asp:Button runat="server" id="okButton" Text="OK" onclick="okButton_Click" />
<script runat="server">
void okButton_Click(object sender, EventArgs e) {
colorPanel.BackColor = Color.FromName(colorTextBox.Text);
}
Imagine now a hacker types in a piece of script code wrapped by the expression function.
expression(alert('hi'))
The final HTML for the panel above would be:
<div id="colorPanel" style="background-color:expression(alert('hi'));">
What's expression? It is a proposed CSS function notation introduced with IE50 to support dynamic properties. Basically, it makes any script wrapped by run. That's what really matters in the end... Note that the same won't happen with eval().
What can you do about it? Avoid using Color.FromName, in first place. You can replace it either with ColorTranslator.FromHTML or more in general with the ColorConverter class. Use this
colorPanel.BackColor = ColorTranslator.FromHTML(colorTextBox.Text);
or in alternative this one:
colorPanel.BackColor = ColorConverter.ConvertFromString(colorTextBox.Text);
Both classes validate the input string before they return a Color object. Which one is better? From the security standpoint, they're equivalent. Both catch the invalid input while trying to extract a RGB triplet from the passed string. The error you get is raised during a String-to-Int32 conversion. ColorConverter is more powerful to handle string colors because designed to accept a wider range of input strings.
In summary, this security advice applies to all the cases in which you're setting properties using dynamically specified color strings--textboxes, request params, cookies, and so on. Using colors may configure a cross-site scripting attack; of course, for the attack to work you should have ValidateRequest turned off.
PS: Wow. I just wonder how many other similar holes are there still to be noticed (by white hats...)