Archive

Archive for April 26, 2020

StyleCop error – The parameter is incorrect

Other day, I encountered following error while triggering ‘Run StyleCop‘ from Visual Studio.

StyleCop_Error

Reason & Fix:

  • In my case, I cloned a DevOps branch and ran the ‘Run StyleCop’ without building the code.
  • Since there were no executable’s, StyleCop thrown error ‘The parameter is incorrect‘.
  • Build the solution and ‘Run StyleCop’ should fix the issue.

StyleCop_Error_1

🙂

XML External Entity Injection – Fix

We have a Web Service, which accepts ‘XML’ payload from client and processes.

Recently the ‘Web Service’ underwent Penetration testing (Also called ‘Ethical hacking’) and following vulnerability has been identified:

PenTest_1

Reason:

  • Our Web Service, processes the XML payload submitted by client using the following code snippet:

PenTest_2

  • We were not having XML payload validation in place.
  • There is possibility that hacker can inject malicious content in the XML and can cause a denial of service condition, gain access to unauthorized information available on the server where the ‘Web Service’ was hosted.

Fix:

  • We could fix the issue by setting ‘XmlResolver’ property to ‘Null’.
  • External resources are resolved using the ‘XmlResolver’ provided via XmlDocument.XmlResolver property, by setting ‘XMlResolver’ to Null, XML Parser would not resolve the external resources, which prevents accessing external resources (i.e., Files in the Serer where Web Service hosted).
  • Change the ‘XmlDocument’ object instantiation as below with ‘XmlResolver’ set to ‘Null’ solved our issue.

var xmlDocument = new XmlDocument { XmlResolver = null };

🙂