It is recommended you test and apply the new version as soon as possible.

The vulnerability only affects the HTML sanitizer. The sanitizer has been changed to remove all CSS it encounters, this new behaviour means that if you were expect CSS formatting to remain after sanitization this is no longer the case.

In addition to the change necessary to correct the vulnerability there are a few new features;

• Minimum Requirements.
  You can now, once again, use the encoder libraries with .NET 2.0. The installer will create directories for each framework version supported, .NET 2.0, .NET 3.5 and .NET 4.0 which contain an optimized version of the encoders for that platform.

• Invalid Unicode no longer throws an exception.
  Invalid Unicode characters are now replaced with the Unicode replacement character, U+FFFD (�). Previously, when encoding strings through HtmlEncode, HtmlAttributeEncode, XmlEncode, XmlAttributeEncode or CssEncode invalid Unicode characters would be detected and an exception thrown.

• UrlPathEncode added.
  The encoding library now has UrlPathEncode which will encode a string for use as the path part of a URL.

• .NET 4.0 encoder support.
  There’s finally an official way to swap AntiXSS into the framework. If you are using .NET 4.0 ensure you are using the .NET 4.0 version of the encoding library and then edit your web.config and add the encoderType attribute to the httpRuntime element; i.e.
  <httpRuntime encoderType="Microsoft.Security.Application.AntiXssEncoder, AntiXssLibrary"/>

The nuget package does not swap out the encoder as nuget configuration transforms can’t be made framework version specific yet so you will have to do that manually. Source code will uploaded to codeplex within the next few days.

Remember that downloading the new version is not enough – you will need to update your projects to use the new version then publish them to your web servers.

This release has also merged code from the .NET framework, taking some of their hard work in integrating the core AntiXSS functions into v4.5. There are some performance improvements in encoding.

I wanted to provide an update to the CAT.NET project since it’s been a while since my last communication. Internally we have version 2.0 of CAT.NET running. Unfortunately, some of the features we relied on in Visual Studio’s code analysis did not make it into the final product. We are working with the Visual Studio team to include the features needed.

In the meantime our team has been investigating options to bypass the missing libraries. This is not an ideal solution because we’ll be omitting the seamless integration with Visual Studio. We believe we have a solution and have provided estimates to fix this problem. Because this effort was not planned, we are investigating how to fit this effort into our current work load. We should have some news by the end of March if not sooner.

Minimum Requirements

.NET Framework 3.5

Return Values

If you pass a null as the value an encoding function the function will now return null. The previous behavior was to return String.Empty.

Medium Trust Support

The HTML Sanitization methods, GetSafeHtml() and GetSafeHtmlFragment() have been moved to a separate assembly. This enables the AntiXssLibrary assembly to run in medium trust environments, a common user request. If you wish to use the Html Sanitization library you must now include the HtmlSanitizationLibrary assembly. This assembly requires full trust and the ability to run unsafe code.

Adjustable safe-listing for HTML/XML Encoding

The safe list for HTML and XML encoding is now adjustable. The UnicodeCharacterEncoder.MarkAsSafe() method allows to you choose from the Unicode Code Charts which languages your web application normally accepts. Safe-listing a language code chart leaves the defined characters in their native form during encoding, which increases readability in the HTML/XML document and speeds up encoding. Certain dangerous characters will also be encoded.

The language code charts are defined in the Microsoft.Security.Application.LowerCodeCharts, Microsoft.Security.Application.LowerMidCodeCharts, Microsoft.Security.Application.MidCodeCharts, Microsoft.Security.Application.UpperMidCodeCharts and Microsoft.Security.Application.UpperCodeCharts enumerations.

It is suggested you safe list your acceptable languages during your application initialization.

Invalid unicode character detection

If any of the HTML or XML encoding methods encounter a character with a character code of 0xFFFE or 0xFFFF, the characters used to detect byte order at the beginning of files an InvalidUnicodeValueException will be thrown.

Surrogate Character Support in HTML and XML encoding

Support for surrogate character pairs for Unicode characters outside the basic multilingual plane has been improved. Such character pairs are now combined and encoded as their &xxxxx; value. If a high surrogate pair character is encountered which is not followed by a low surrogate pair character, or a low surrogate pair character is encountered which is not preceded by a high surrogate pair character an InvalidSurrogatePairException is thrown.

HTML 4.01 Named Entity Support

A new overload of the HtmlEncode method, Encoder.HtmlEncode(string input, bool useNamedEntities) allows you to specify if the named entities from the HTML 4.01 specification should be used in preference to &#xxxx; encoding when a named entity exists. For example if useNamedEntities parameter is set to true the copyright entity would be encoded as ©.

HtmlFormUrlEncode

A new encoding type suitable for using in encoding Html POST form submissions is now available via Encoder.HtmlFormUrlEncode. This encodes according to the W3C specifications for application/x-www-form-urlencoded MIME type.

LDAP Encoding changes

The LdapEncode function has been deprecated in favor of two new functions, Encoder.LdapFilterEncode(string) and Encoder.LdapDistinguishedNameEncode(string)

Encoder.LdapFilterEncode encodes input according to RFC4515 where unsafe values are converted to \XX where XX is the representation of the unsafe character

Encoder.LdapDistinguishedNameEncode encodes input according to RFC 2253 where unsafe characters are converted to #XX where XX is the representation of the unsafe character and the comma, plus, quote, slash, less than and great than signs are escaped using slash notation (\X). In addition to this a space or octothorpe (#) at the beginning of the input string is \ escaped as is a space at the end of a string.

LdapDistinguishedNameEncode(string, bool, bool) is also provided so you may turn off the initial or final character escaping rules, for example if you are concatenating the escaped distinguished name fragment into the midst of a complete distinguished name.

MarkOutput

The ability to mark output using an HtmlEncode overload and query string parameter has been removed.

The Security Runtime Engine developer continues in parallel to my other work, but we’ve now separated the two libraries so you don’t have to wait for AntiXSS updates. The WPL will continue to be available as source only from  codeplex until we’re happy with the code model and quality. Once that happens you can expect to see a binary release, but there are no planned release dates as yet.

1. From the presented Launchpad under the “Quick Actions” Section screen click on the “View scan results” link or go to “File” menu and select “View scan results”. You can also get to this screen by clicking on the “View Report” button after a scan, which will automatically select that scan for the report.

2. From the first drop down box, select a server to view a scan result. The drop down box displays all the server names for which results have been generated by the tool. Upon selecting the server name, the list box displays the scanned dates and times starting with latest date and timestamp.

3. The report is divided into multiple sections. You can navigate to corresponding section by clicking the links in summary table. There are four sections for every report. First is the Summary, which tells you about the machine and its specific attributes. This section also serves as the index allowing you to select a link to jump to that specific section. The next section is the General application Rules. This is where all rules pertaining to a machine regardless to the machines purpose. The next section contains the IIS Application rules. If a user knows this machine is an IIS box then this section should have all the security rules for IIS in one contained section. The last section is for SQL server. Assuming the server is a SQL server machine all rules pertaining to SQL Server will be in this section.

4. Results from scanning a machine falls into one of four states: Passed, Failed, Indeterminate and Not Applicable. Passed indicates the rules was tested and based on WACA’s scan discovery the rule passed. Failed indicates after the rule was scanned for the discovery was the rule failed the test. Not Applicable state is used when specific application such as IIS or SQL Server is not present on the target machine. Indeterminate state is applied when a specific rule cannot find the underlying data due to missing information to process the rule. For example, Indeterminate state could be returned for the “Unnecessary service (Alerter) is not running” rule if the service itself is not present on the target machine. Investigate indeterminate rules by using the descriptions and resolutions from Excel export.

5. Severity and resolution provide additional context to the rule and only failed rules include resolutions to fix the violation. Context may determine whether a failure in WACA is a bug to be fixed. Some checks, for example, are applicable for servers facing the extranet, but would be considered false positives for any other environment. The description for the checks provides guidance for these scenarios.

6. Exporting to Excel and using the Filter feature can help with quickly identifying and managing failures.

Thanks
Anil RV

1. Launch the application by going to Windows Start Menu and selecting “Microsoft Information Security”, “Web Application Configuration Analyzer v1.0” and “Web Application Configuration Analyzer”.

2. From the presented Launchpad screen under the “Quick Actions” Section click on the “Scan a machine” link or go to “File” menu and select “Scan a machine”.

3. Enter the fully qualified domain name of the target machine and click “Scan” button to start the scan. You can also enter the SQL instance name to scan a SQL server on that machine.

Note that you need administrative permissions on the target machine along with remote registry and WMI services. The tool will perform prerequisite scanning first to determine server existence, administrative access, IIS and SQL versions and remote services availability. If WACA is unable to connect to the SQL Server either because of network or permission issues, the user will be prompted to continue the scan.

4. It is not required that the target machine have either IIS or SQL installed, WACA will recognize this and report its results accordingly.

5. A message is displayed indicating that the scan is completed. Click on the “View Report” button to view the report.

Thanks
Anil RV

Web Application Configuration Analyzer (WACA) is a tool that scans a server against a set of best practices recommended for pre-production and production servers. It can also be used by developers to ensure that their codebase works within a secure / hardened environment (although many of the checks are not as applicable for developers). The list of best practices is derived from the Microsoft Information Security & Risk Management Deployment Review Standards used internally at Microsoft to harden production and pre-production environments for line of business applications. The Deployment Review standards themselves were derived from content released by Microsoft Patterns & Practices, in particular: Improving Web Application Security: Threats and Countermeasures available at: http://msdn.microsoft.com/en-us/library/ms994921.aspx. It uses an agent-less scan that requires the user to have admin privileges on the target server, as well as any SQL Server instances running on that machine.

• Scan a machine for more than 140 rules
• Generate HTML based reports
• Compare two scans to view the differences
• Export results to Excel
• Export results to Team Foundation Server

You can download the tool from http://www.microsoft.com/downloads/en/details.aspx?FamilyID=60585590-57df-4fc1-8f0c-05a286059406. You can view a demo of the tool in this channel9 screencast.

Thanks
Anil RV

Frank Brisse here… I wanted to provide an update on CAT.NET v2.0.  We were looking to release CAT.NET v2.0 in June but ran into a design issue at the last moment causing us to delay the release.  At this point we are working with internal teams to determine how to best fix this concern.  Once we have a solution and a definitive timeframe we’ll announce the new release date. 

While we’re looking to resolve this issue we still want to hear your feedback about features needed in future releases.  Shortly we’ll release a list of features that will be included in CAT.NET v2.0 and items on the product backlog for future releases.

We haven’t released binaries because it’s just a preview, it is in no way ready for production.

So why make the source available? We want feedback. This represents a rewrite of the Security Runtime and a new way for you to easily write plug-ins for it. Rather than simply decide what’s best for our users we wanted to show you the direction we’re taking and give you a change to influence it.

Missing from the sure are any tests – they do exist and will be published in the next source drop. There are no inspectors or logging plug-ins – because we would like you to work through the tutorial, then look through the code, think about how you would use them and try to write your own. If we supplied some example inspectors the temptation would be there to use those as a starting template for your own.

So please download, read the source, play around (on a test web site) and do leave feedback and bug reports/issues for us on CodePlex.

Barry

It is with some degree of sadness that I have to hang up my spurs from this blog. Next Monday I take up a new role on the Server & Tools Online team (think MSDN & codeplex.com) where I will be heading up the subscriptions engineering team. I have held various security roles in big and small companies for the last 15 years and so it is very much a new chapter in my life as I follow my passions of modern development practices, online community and user experience. I call it Curphey 2.0!

The work of the Security Tools team will not change or be affected in any way. There is great work continuing including CAT.NET, WPL and WACA (as well as a whole lot more internal implementation engineering on Identity Management and other related security management tools). There is a LONG overdue release of CISF and updates due on the Security BI and Risk Tracker work we have been cranking out. The team will continue to use this blog to communicate public releases and share their work and learning's.

It has been an honor and a pleasure to work with the team. It is a very talented bunch of folks who have made work fun! You can follow my new adventures at my new personal blog http://www.curphey.com and as usual on Twitter using @curphey (or http://www.twitter.com/curphey). I will be posting some notes over on the BlueHat blog about my talk in Beunos Aires next week and have one final security keynote “10 Crazy Ideas That Might Actually Change the State of Information Security”

One of the things I have been blown away by at Microsoft is the Corporate Citizenship and the culture of giving. It’s a part of our corporate culture that I think we can be very proud of. As I transition to my new role I wanted to share something personal. Before I move on I have a personal plea. Yes it’s a plea, a plea to your kind hearts and good nature. Last week I signed up to run the Seattle Rock’N’Roll Marathon with The Leukemia & Lymphoma Society’s (LLS) Team In Training. The run is on June 26th, 2010 and I am raising money to help fight blood cancer. I am not going for pace, I just want to finish and raise money for a good cause. I just want to do something good. For a few years I have wanted to do a marathon as one of those things to tick off of the “been there and done that in Life” list but more importantly I know a few people who have been in dealing with cancer of various forms. One friend has a 9 year old son who has been dealing with a brain and a spine tumor for most of his life (I am not going to tug on your heart strings too much but it’s a heart breaking story) and another good friend (my age)  is now recovering from Lupus. The chemotherapy has literally disintegrated his bones to the point where he has had to have his hips replaced so he can walk. He will never be able to run with his kids like I can. My minor skin cancer scares pale into insignificance when you see what others go through and a little bit of pain on a 26 mile run will be negligible in order to help advance the research and prevent others from suffering. I am healthy and alive; getting fit and a few blisters will be a breeze in comparison to what others go through.

PLEASE SPONSOR ME!

Please, please consider sponsoring me and raising money to flight blood cancer. I am happy to accept sponsorship if you want to induce pain in me or help relieve if from others!

My Team in Training Sponsorship page can be found here.  If you work for Microsoft it has directions on how to ensure that Microsoft matches your donation so together we can double the donation for employees.

All donations help. Anything helps! It’s for a great cause!

As I live in a “Connected World” you can even track my run stats on the Garmin Connect site here using an RSS reader to see just how tough I am finding it!

Thanks for your support!

PS : I am also happy to do speaking events, write articles, consider endorsements or wear your company logo in return for donations.  You can write to me at mark at curphey dot com with suggestions.