Avoid using protocols without SSL

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST ルール > Avoid using protocols without SSL

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

ID: csharp-security/avoid-unencrypted-protocols

Language: C#

Severity: Warning

Category: Security

CWE: 319

Related CWEs:

1428

Description

Using http:// or ftp:// instead of https:// or ftps:// leads to potential cleartext data transmission. Always use safe and secure connections.

Learn More

CWE-319: Cleartext Transmission of Sensitive Information

Non-Compliant Code Examples

using System.IO;
using System.Security.Cryptography;

class MyClass {
    public void Encrypt(byte[] key, byte[] dataToEncrypt, MemoryStream target)
    {
        foobar(key, something, "http://domain.tld", plop);
        var url1 = "http://test.com";
    }
}

using System.IO;
using System.Security.Cryptography;

class MyClass {
    public void Encrypt(byte[] key, byte[] dataToEncrypt, MemoryStream target)
    {
        foo.bar(key, something, "http://domain.tld", plop);
    }
}

using System.IO;
using System.Security.Cryptography;

class MyClass {
    public void Encrypt(byte[] key, byte[] dataToEncrypt, MemoryStream target)
    {
        var httpUrl = "http://domain.tld";
        var ftpUrl = "ftp://";
    }
}

Compliant Code Examples

using System.IO;
using System.Security.Cryptography;

class MyClass {
    public void Encrypt(byte[] key, byte[] dataToEncrypt, MemoryStream target)
    {
        var httpUrl = "https://domain.tld";
        var ftpUrl = "ftps://";
        var bool1 = str.Contains("http://") || str.IndexOf("http://");
        var sanitized = url.Replace("http://", "https://")
        var claimType = "http://schemas.microsoft.com/ws/2008/06/identity/claims/userdata";
        var customClaimType = "http://api.example.com/2012/identity/claims/hash";
        var w3website = "http://www.w3.org/2001/XMLSchema-instance";
    }
}

public static class PaymentConstants
{
    public const string MonextImplNamespace = "http://impl.ws.payline.experian.com";
    public const string MonextObjNamespace = "http://obj.ws.payline.experian.com";
    public const string MonextSoapNamespace = "http://schemas.xmlsoap.org/soap/envelope/";
    public const string SomeSchema = "http://vendor.example.com/schema/v2";
}

using System.Xml;

class MyClass {
    public void Setup(XmlNamespaceManager nsmgr) {
        nsmgr.AddNamespace("soap", "http://schemas.xmlsoap.org/soap/envelope/");
        nsmgr.AddNamespace("wsdl", "http://schemas.xmlsoap.org/wsdl/");
    }
}