Author: gonzalo
Date: 2005-09-23 18:03:12 -0400 (Fri, 23 Sep 2005)
New Revision: 50634
Removed:
trunk/mcs/class/System.Web/System.Web.UI/ViewStateOutputHashStream.cs
Modified:
trunk/mcs/class/System.Web/System.Web.UI/ChangeLog
trunk/mcs/class/System.Web/System.Web.UI/LosFormatter.cs
trunk/mcs/class/System.Web/System.Web.UI/Page.cs
Log:
2005-09-23 Gonzalo Paniagua Javier <[EMAIL PROTECTED]>
* ViewStateOutputHashStream.cs: Removed. It didn't last long.
* Page.cs: almost restored to its previous state, but now that we found
that LosFormatter ctor that takes 'enableMac', moved the logic to
add the hash and validate there. Thanks to Sebastien for his input.
* LosFormatter.cs: implemented the missing ctors and support for
"MAC" validation of the data.
Modified: trunk/mcs/class/System.Web/System.Web.UI/ChangeLog
===================================================================
--- trunk/mcs/class/System.Web/System.Web.UI/ChangeLog 2005-09-23 22:01:25 UTC
(rev 50633)
+++ trunk/mcs/class/System.Web/System.Web.UI/ChangeLog 2005-09-23 22:03:12 UTC
(rev 50634)
@@ -1,5 +1,16 @@
2005-09-23 Gonzalo Paniagua Javier <[EMAIL PROTECTED]>
+ * ViewStateOutputHashStream.cs: Removed. It didn't last long.
+
+ * Page.cs: almost restored to its previous state, but now that we found
+ that LosFormatter ctor that takes 'enableMac', moved the logic to
+ add the hash and validate there. Thanks to Sebastien for his input.
+
+ * LosFormatter.cs: implemented the missing ctors and support for
+ "MAC" validation of the data.
+
+2005-09-23 Gonzalo Paniagua Javier <[EMAIL PROTECTED]>
+
* Page.cs:
* ViewStateOutputHashStream.cs: added support for viewstate MAC. It
prevents the viewstate being altered on the client and it's disabled
Modified: trunk/mcs/class/System.Web/System.Web.UI/LosFormatter.cs
===================================================================
--- trunk/mcs/class/System.Web/System.Web.UI/LosFormatter.cs 2005-09-23
22:01:25 UTC (rev 50633)
+++ trunk/mcs/class/System.Web/System.Web.UI/LosFormatter.cs 2005-09-23
22:03:12 UTC (rev 50634)
@@ -3,6 +3,7 @@
//
// Authors:
// Ben Maurer ([EMAIL PROTECTED])
+// Gonzalo Paniagua Javier ([EMAIL PROTECTED])
//
// (C) 2003 Ben Maurer
// Copyright (C) 2005 Novell, Inc (http://www.novell.com)
@@ -28,7 +29,9 @@
//
using System.IO;
+using System.Security.Cryptography;
using System.Security.Permissions;
+using System.Text;
namespace System.Web.UI {
@@ -37,29 +40,62 @@
public sealed class LosFormatter {
ObjectStateFormatter osf = new ObjectStateFormatter ();
+ bool disable_mac;
+ HashAlgorithm algo;
public LosFormatter ()
{
}
#if NET_1_1
- [MonoTODO]
public LosFormatter (bool enableMac, string macKeyModifier)
+ : this (enableMac, Encoding.UTF8.GetBytes
(macKeyModifier))
{
- // FIXME - is this used ???
}
#endif
+ [MonoTODO]
#if NET_2_0
- [MonoTODO]
- public LosFormatter (bool enableMac, byte[] macKeyModifier)
+ public
+#else
+ internal
+#endif
+ LosFormatter (bool enableMac, byte[] macKeyModifier)
{
- throw new NotImplementedException ();
+ this.disable_mac = !enableMac;
+ if (enableMac)
+ algo = new HMACSHA1 (macKeyModifier);
}
-#endif
+ void ValidateInput (byte [] data, int offset, int size)
+ {
+ int hash_size = algo.HashSize / 8;
+ if (size != 0 && size < hash_size)
+ throw new HttpException (400, "Unable to
validate data.");
+
+ int data_length = size - hash_size;
+ MemoryStream data_stream = new MemoryStream (data,
offset, data_length, false, false);
+ byte [] hash = algo.ComputeHash (data_stream);
+ for (int i = 0; i < hash_size; i++) {
+ if (hash [i] != data [data_length + i])
+ throw new HttpException (400, "Unable
to validate data.");
+ }
+ }
+
public object Deserialize (Stream stream)
{
- return osf.Deserialize (stream);
+ if (disable_mac)
+ return osf.Deserialize (stream);
+
+ byte [] bytes = new byte [stream.Length >= 0 ?
stream.Length : 2048];
+ MemoryStream ms = new MemoryStream ();
+ int n;
+ while ((n = stream.Read (bytes, 0, bytes.Length)) > 0)
+ ms.Write (bytes, 0, n);
+
+ byte [] buffer = ms.GetBuffer ();
+ int length = (int) ms.Length;
+ ValidateInput (buffer, 0, length);
+ return osf.Deserialize (new MemoryStream (buffer, 0,
length, false, false));
}
public object Deserialize (TextReader input)
@@ -72,12 +108,41 @@
public object Deserialize (string input)
{
- return osf.Deserialize (input);
+ if (disable_mac)
+ return osf.Deserialize (input);
+
+ byte [] input_bytes = Convert.FromBase64String (input);
+ ValidateInput (input_bytes, 0, input_bytes.Length);
+ return osf.Deserialize (new MemoryStream (input_bytes,
0, input_bytes.Length, false, false));
}
+ void SerializeAndHash (MemoryStream ms, object value)
+ {
+ osf.Serialize (ms, value);
+ if (ms.Length == 0)
+ return;
+
+ byte [] hash = algo.ComputeHash (ms.GetBuffer (), 0,
(int) ms.Length);
+ ms.Write (hash, 0, hash.Length);
+ }
+
public void Serialize (Stream stream, object value)
{
- osf.Serialize (stream, value);
+ if (disable_mac) {
+ osf.Serialize (stream, value);
+ return;
+ }
+
+ MemoryStream ms = new MemoryStream ();
+ if ((stream is MemoryStream) && stream.Position == 0) {
+ ms = (MemoryStream) stream;
+ } else {
+ ms = new MemoryStream ();
+ }
+
+ SerializeAndHash (ms, value);
+ if (ms != stream)
+ ms.WriteTo (stream);
}
public void Serialize (TextWriter output, object value)
@@ -85,7 +150,15 @@
if (output == null)
throw new ArgumentNullException ("output");
- output.Write (osf.Serialize (value));
+ if (disable_mac) {
+ output.Write (osf.Serialize (value));
+ return;
+ }
+
+ MemoryStream ms = new MemoryStream ();
+ SerializeAndHash (ms, value);
+ output.Write (Convert.ToBase64String (ms.GetBuffer (),
0, (int) ms.Length));
}
}
}
+
Modified: trunk/mcs/class/System.Web/System.Web.UI/Page.cs
===================================================================
--- trunk/mcs/class/System.Web/System.Web.UI/Page.cs 2005-09-23 22:01:25 UTC
(rev 50633)
+++ trunk/mcs/class/System.Web/System.Web.UI/Page.cs 2005-09-23 22:03:12 UTC
(rev 50634)
@@ -99,7 +99,6 @@
protected const string postEventArgumentID = "__EVENTARGUMENT";
[EditorBrowsable (EditorBrowsableState.Never)]
protected const string postEventSourceID = "__EVENTTARGET";
- const int HASH_SIZE = 16;
#if NET_2_0
internal const string CallbackArgumentID = "__CALLBACKARGUMENT";
@@ -764,23 +763,28 @@
scriptManager.WriteClientScriptBlocks (writer);
}
+ LosFormatter GetFormatter ()
+ {
+ PagesConfiguration config = PagesConfiguration.GetInstance
(_context);
+ byte [] vkey = null;
+ if (config.EnableViewStateMac) {
+ MachineKeyConfig mconfig;
+ mconfig = HttpContext.GetAppConfig
("system.web/machineKey") as MachineKeyConfig;
+ vkey = mconfig.ValidationKey;
+ }
+
+ return new LosFormatter (config.EnableViewStateMac, vkey);
+ }
+
internal string GetViewStateString ()
{
if (_savedViewState == null)
return null;
- LosFormatter fmt = new LosFormatter ();
- PagesConfiguration config = PagesConfiguration.GetInstance
(_context);
- if (false == config.EnableViewStateMac) {
- StringWriter sr = new StringWriter ();
- fmt.Serialize (sr, _savedViewState);
- return sr.GetStringBuilder ().ToString ();
- }
-
- ViewStateOutputHashStream stream;
- stream = new ViewStateOutputHashStream (new MemoryStream
(HASH_SIZE), GetTypeHashCode ());
- fmt.Serialize (stream, _savedViewState);
- return stream.GetBase64String ();
+ LosFormatter fmt = GetFormatter ();
+ MemoryStream ms = new MemoryStream ();
+ fmt.Serialize (ms, _savedViewState);
+ return Convert.ToBase64String (ms.GetBuffer (), 0, (int)
ms.Length);
}
internal object GetSavedViewState ()
@@ -1154,42 +1158,12 @@
if (view_state == "")
return null;
- LosFormatter fmt = new LosFormatter ();
- PagesConfiguration config = PagesConfiguration.GetInstance
(_context);
- if (false == config.EnableViewStateMac) {
- try {
- _savedViewState = fmt.Deserialize (view_state);
- } catch (Exception e) {
- throw new HttpException ("Error restoring page
viewstate.", e);
- }
- } else {
- byte [] bytes = Convert.FromBase64String (view_state);
- int length = bytes.Length;
- if (length < HASH_SIZE)
- throw new HttpException ("Error restoring page
viewstate.");
-
- int data_end = length - HASH_SIZE;
- MemoryStream input = new MemoryStream ();
- input.Write (BitConverter.GetBytes (GetTypeHashCode
()), 0, 4);
- input.Write (bytes, 0, data_end);
- input.Position = 0;
- CryptoStream cs = new CryptoStream (input, SHA1.Create
(), CryptoStreamMode.Read);
- byte [] computed_hash = new byte [HASH_SIZE];
- cs.Read (computed_hash, 0, HASH_SIZE);
- for (int i = 0; i < HASH_SIZE; i++) {
- if (computed_hash [i] != bytes [data_end + i])
- throw new HttpException ("Error
restoring page viewstate.");
- }
-
-
- try {
- input = new MemoryStream (bytes, 0, data_end,
false, false);
- _savedViewState = fmt.Deserialize (input);
- } catch (Exception e) {
- throw new HttpException ("Error restoring page
viewstate.", e);
- }
+ LosFormatter fmt = GetFormatter ();
+ try {
+ _savedViewState = fmt.Deserialize (view_state);
+ } catch (Exception e) {
+ throw new HttpException ("Error restoring page
viewstate.", e);
}
-
return _savedViewState;
}
Deleted: trunk/mcs/class/System.Web/System.Web.UI/ViewStateOutputHashStream.cs
===================================================================
--- trunk/mcs/class/System.Web/System.Web.UI/ViewStateOutputHashStream.cs
2005-09-23 22:01:25 UTC (rev 50633)
+++ trunk/mcs/class/System.Web/System.Web.UI/ViewStateOutputHashStream.cs
2005-09-23 22:03:12 UTC (rev 50634)
@@ -1,63 +0,0 @@
-//
-// System.Web.UI.ViewStateOutputHashStream
-//
-// Authors:
-// Gonzalo Paniagua ([EMAIL PROTECTED])
-//
-// Copyright (c) 2005 Novell, Inc (http://www.novell.com)
-//
-// Permission is hereby granted, free of charge, to any person obtaining
-// a copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so, subject to
-// the following conditions:
-//
-// The above copyright notice and this permission notice shall be
-// included in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-
-using System;
-using System.IO;
-using System.Security.Cryptography;
-
-namespace System.Web.UI {
- class ViewStateOutputHashStream : CryptoStream {
- MemoryStream hash;
- MemoryStream data;
-
- public ViewStateOutputHashStream (MemoryStream ms, int seed) :
- base (ms, SHA1.Create (), CryptoStreamMode.Write)
- {
- this.hash = ms;
- this.data = new MemoryStream ();
- base.Write (BitConverter.GetBytes (seed), 0, 4);
- }
-
- public override void Write (byte[] buffer, int offset, int
count)
- {
- data.Write (buffer, offset, count);
- base.Write (buffer, offset, count);
- }
-
- public string GetBase64String ()
- {
- FlushFinalBlock ();
- if (data.Length == 0)
- return null;
-
- data.Write (hash.GetBuffer (), 0, (int) hash.Length);
- return Convert.ToBase64String (data.GetBuffer (), 0,
(int) data.Length);
- }
- }
-}
-
_______________________________________________
Mono-patches maillist - [email protected]
http://lists.ximian.com/mailman/listinfo/mono-patches
