CAST Management Studio - Information - User Input Security - How to blackbox a method

Purpose

When analyzing the source code of an application, which has a defined analysis scope, some code is analyzed, some is not and is treated as an external code.

Any external code is unknown and cannot be accessed by the analyzer, and as such is not taken into account by the User Input Security feature. Therefore, security problems in this external source code would normally not be detected at all.

In order to resolve this problem CAST has introduced the notion of blackbox methods.

Applicable in CAST Version

Applicable RDBMS

Blackbox a method

Blackboxes are XML files that provide implementation for methods with no source code. you must create one xml file, “My_blackbox.blackbox.xml” (you can create a single file for all methods to blackbox). Save it at  Cast_flat\configuration\blackboxes<YourTechnology>.

• Copy, paste the following code:

<?xml version="1.0" encoding="utf-8"?> 
<BlackBox name="My_blackbox" xmlns="http://tempuri.org/BlackBoxes.xsd"> 
</BlackBox>

• Identify the method that presents the following error “No Implementation found” in SecurityAnalyzer.log.secondary, for example:

INFO: No Implementation found for method "org.owasp.esapi.Encoder.encodeForJavaScript(java.lang.String)"

• Add Class and signature of method to the blackbox. For our example the signature is getConnection(java.lang.String), and the Class is java.sql.DriverManager, the blackbox file will be like follows:

<?xml version="1.0" encoding="utf-8"?> 
	<BlackBox name="My_blackbox" xmlns="http://tempuri.org/BlackBoxes.xsd"> 
		<Class id="1" mangling="org.owasp.esapi.Encoder"> 
			</Methods> 
				<Method signature="encodeForJavaScript(java.lang.String)">     
					
				</Method>			
			</Methods>   
		</Class> 
	</BlackBox>

• Write the body of blackbox : The body of blackbox depend on the semantics you want to give, as well as the number of parameters of the method. For our example if the method is sanitization method with one parameter, the blackbox will be like:

<?xml version="1.0" encoding="utf-8"?> 
	<BlackBox name="My_blackbox" xmlns="http://tempuri.org/BlackBoxes.xsd"> 
		<Class id="1" mangling="org.owasp.esapi.Encoder"> 
			</Methods> 
				<Method signature="encodeForJavaScript(java.lang.String)">     
					<Flow source="1" sink="0" mode="assign" />
    					<Flow source="0" sink="-1" mode="assign" />  
				</Method>			
			</Methods>   
		</Class> 
	</BlackBox>

In general case the blackbox of your method will take the same form as one of the following patterns (Assuming that method have n parameters (method (1, .., n)):

1. If method is sanitization:

<Flow source="1" sink="0" mode="alternative" /> 
... 
<Flow source="n" sink="0" mode="alternative" /> 
<Flow source="0" sink="-1" mode="assign" /

<Flow caller="[cast#lib]Network.read" sink="-1" mode="receive" />

6. If method is Path Manipulation:

   ```xml
<Flow source="1" callee="[cast#lib]File.open" 
mode="send"/> 
... 
<Flow source="n" callee="[cast#lib]File.open" 
mode="send"/> 
 
<Flow source="1" sink="0" mode="alternative" /> 
... 
<Flow source="n" sink="0" mode="alternative" />
<Flow source="0" sink="-1" mode="assign" /

8. If method is Log forging:

   ```xml
<Flow source="1" 
callee="[cast#lib]Log.write"
mode="send"/> 
... 
<Flow source="n" callee="[cast#lib]Log.write"
 mode="send"/>

10. If method is cross-site scripting with parameters:

    ```xml
<Flow source="1" callee="[cast#lib]Network.write" 
mode="send"/> 
... 
<Flow source="n" callee="[cast#lib]Network.write" 
mode="send"/>

12. If method is Format injection:

    ```xml
<Flow source="1" callee="[cast#lib]String.format" 
$mode="send"/>
... 
<Flow source="n" callee="[cast#lib]String.format"
mode="send"/>

**Notes/comments**

**Related Pages**