Develop Reference

How to fix “XPath Injection” in c# asp.net? Fortify issue

I got a “XPath Injection” issue from Fortify scan for below code,
string username = string.Empty;
string password = string.Empty;
string officePrefix = "";
if (!String.IsNullOrEmpty(securityNode.Prefix))
{
officePrefix = securityNode.Prefix + ":";
ns.AddNamespace(securityNode.Prefix, securityNode.Namespace);
}
var regexPattern =
ConfigurationManager.AppSettings["xxx"];
var regexItem = new Regex(regexPattern, RegexOptions.None);
if(regexItem.IsMatch(officePrefix ))
{
//wsse:UsernameToken
XmlNode usernameTokenNode = securityNode.SelectSingleNode(officePrefix +
"UsernameTkn", ns);
username = usernameTokenNode.SelectSingleNode(officePrefix + "name", ns).InnerText;
password = usernameTokenNode.SelectSingleNode(officePrefix + "Pwd", ns).InnerText;
above code i am getting issue from ( XmlNode usernameTokenNode = securityNode.SelectSingleNode(officePrefix +
"UsernameToken", ns);) this line of code. So, I tried to use regex and as you can see in the code. Even though the xpath injection issue still persists. Can any one kindly give a solution for the xpath injection issue.

You don't need to re-use the namespace alias from the actual XML. you can use your own. The only thing is that the actual namespace must be the same
string username = string.Empty;
string password = string.Empty;
const string officePrefix = "myPrefix";
bool hasPrefix = !string.IsNullOrEmpty(securityNode.Namespace);
if (hasPrefix)
{
ns.AddNamespace(officePrefix, securityNode.Namespace);
}
XmlNode usernameTokenNode = securityNode.SelectSingleNode(hasPrefix ? officePrefix + ":UsernameTkn" : "UsernameTkn", ns);
username = usernameTokenNode.SelectSingleNode(hasPrefix ? officePrefix + ":name" : "name", ns).InnerText;
password = usernameTokenNode.SelectSingleNode(hasPrefix ? officePrefix + ":Pwd" : "Pwd", ns).InnerText;
I note that XName and XNode are newer and much easier to use, they are in the System.Xml.Linq library.

Change datasource using bartender dynamically using c#

I'm populating fields data from database with bartender but I'm not able to do same while changing database from code,
e.g. There is a template called TestLBL.btw and in the template we have configured database field say TestDB.Name field now I've another database say TestDB2 and that have exact same fields as TestDB now I just wanted to print label with same field with different database(TestDB2) using c# code but that doesn't works :(
below is my sample code :
btnEngine = new Engine();
btnEngine.Start();
lblDoc = btnEngine.Documents.Open(ConfigurationManager.AppSettings["BarTenderTemplate_Path"] + templateName);
var msg = new Messages();
var resolution = new Resolution(300);
string connectString = ConfigurationManager.ConnectionStrings["TestDB2"].ConnectionString;
SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connectString);
lblDoc.DatabaseConnections[0].Name = builder.InitialCatalog;
lblDoc.DatabaseConnections[0].Server = builder.DataSource;
lblDoc.DatabaseConnections[0].UserID = builder.UserID;
lblDoc.DatabaseConnections[0].SetPassword(builder.Password);
lblDoc.DatabaseConnections.SetDatabaseConnection(lblDoc.DatabaseConnections[0]);
lblDoc.DatabaseConnections.QueryPrompts["pRec_Key"].Value = Rec_key.ToString();
lblDoc.DatabaseConnections.QueryPrompts["pImage_Path"].Value = Image_Path;
var fileName = templateName.Split('.')[0] + "_" + Rec_key.ToString() + ".pdf";
var fileFullPath = Path.GetDirectoryName(ConfigurationManager.AppSettings["BarTenderTemplate_Path"]) + "\\" + templateName.Split('.')[0] + "_" + Rec_key.ToString() + ".pdf";
var result = lblDoc.ExportPrintPreviewToFile(Path.GetDirectoryName(ConfigurationManager.AppSettings["BarTenderTemplate_Path"]), fileName, ImageType.PDF
, ColorDepth.ColorDepth24bit, resolution, Color.White, OverwriteOptions.Overwrite, true, true, out msg);
lblDoc.Close(SaveOptions.SaveChanges);
It throws an error in below line, without any inner exception,
var result = lblDoc.ExportPrintPreviewToFile(Path.GetDirectoryName(ConfigurationManager.AppSettings["BarTenderTemplate_Path"]), fileName, ImageType.PDF
, ColorDepth.ColorDepth24bit, resolution, Color.White, OverwriteOptions.Overwrite, true, true, out msg);
Any help would be appreciated.!

I could not comment the post so i'll ask my question here:
What is the error message in this line?
var result =
lblDoc.ExportPrintPreviewToFile(
Path.GetDirectoryName(ConfigurationManager.AppSettings["BarTenderTemplate_Path"]),
fileName,
ImageType.PDF,
ColorDepth.ColorDepth24bit,
resolution,
Color.White,
OverwriteOptions.Overwrite, true, true, out msg);
Did you set up TestDB2 in your BTW file database?
string connectString = ConfigurationManager.ConnectionStrings["TestDB2"].ConnectionString;
Did your fileName valid?
var fileName = templateName.Split('.')[0] + "_" + Rec_key.ToString() + ".pdf";

C#: Create Resource file with values having French characters

In my C# console application, using google translate service I am programmatically trying to translate MyResources.resx file into MyResources.fr-CA.resx
Here is the code:
public static string TranslateText(string input, string languagePair)
{
string url = String.Format("http://www.google.com/translate_t?hl=en&ie=UTF8&text={0}&langpair={1}", input, languagePair);
WebClient webClient = new WebClient();
webClient.Encoding = System.Text.Encoding.UTF8;
string result = webClient.DownloadString(url);
result = result.Substring(result.IndexOf("<span title=\"") + "<span title=\"".Length);
result = result.Substring(result.IndexOf(">") + 1);
result = result.Substring(0, result.IndexOf("</span>"));
return result.Trim();
}
static void Main(string[] args)
{
var resWriter = new ResourceWriter("Translations.resources");
ResourceSet resourceSet = MyResources.ResourceManager.GetResourceSet(CultureInfo.CurrentUICulture, true, true);
foreach (DictionaryEntry entry in resourceSet)
{
string resKey = entry.Key.ToString();
string resValue = entry.Value.ToString();
var result = TranslateText(resValue, "en|fr-CA");
if (result != null)
{
resWriter.AddResource(resKey, System.Web.HttpUtility.HtmlDecode(result));
}
}
resWriter.Close();
}
Problem is that some french characters show up as "?" character in resulting Resources.fr-CA.resx file and that also, only if I use System.Web.HttpUtility.HtmlDecode, otherwise it shows characters for example like "d&#39"
So how can I programmatically insert French based values in a resource file correctly?

You have to change your webClient encoding type to decode French characters properly.
So this line:
webClient.Encoding = System.Text.Encoding.UTF8;
Have to be like this:
webClient.Encoding = System.Text.Encoding.GetEncoding("ISO-8859-1");
and your "result" variable (after calling TranslateText method) should be readable in French correctly.
Please try this way and inform me, it worked for me.
Regards.

Lotus Notes Sending email with options

I'm using Lotus Domino.dll. Already finished sending. How set delivery options to DeliveryPriority=H and DeliveryReport=C?
CODE
NotesSession _notesSession = new NotesSession();
NotesDocument _notesDocument = null;
string sMailFile = "mail/" + login + ".nsf";
_notesSession.Initialize(passwrod);
NotesDatabase _notesDataBase = _notesSession.GetDatabase(sServerName, sMailFile, false);
if (!_notesDataBase.IsOpen)
{
_notesDataBase.Open();
}
_notesDocument = _notesDataBase.CreateDocument();
_notesDocument.ReplaceItemValue("Form", "Memo");
_notesDocument.ReplaceItemValue("SendTo", aSendTo);
_notesDocument.ReplaceItemValue("Subject", aSubject);
NotesRichTextItem _richTextItem = _notesDocument.CreateRichTextItem("Body");
_richTextItem.AppendText(text + "\r\n");
_richTextItem.EmbedObject(EMBED_TYPE.EMBED_ATTACHMENT, "", file);
var oItemValue = _notesDocument.GetItemValue("SendTo");
_notesDocument.SaveMessageOnSend = true;
_notesDocument.Send(false, ref oItemValue);

Add the lines
_notesDocument.ReplaceItemValue("DeliveryPriority", "H");
_notesDocument.ReplaceItemValue("DeliveryReport", "C");
after your Subject line.
You can find a complete list of mail options here.

Get GPO information using Microsoft.GroupPolicy

We're trying to get the information of GPOs of our computers. Therefore we want to use c# - and not gpresult.exe (because it can be executed in system context...).
Well, as I found out there's a DLL Microsoft.GroupPolicy.Management.dll that can be imported in C#. It sounded too easy:
using Microsoft.GroupPolicy;
[...]
GPRsop rsop = new GPRsop(RsopMode.Logging, "root\\RSOP\\Computer");
rsop.LoggingComputer = "MyComputer";
rsop.LoggingUser = "domain\\user";
rsop.LoggingMode = LoggingMode.Computer;
rsop.CreateQueryResults();
rsop.GenerateReportToFile(ReportType.Xml, "C:\\Temp\\test.xml");
As output file I get this one:
<?xml version="1.0" encoding="utf-16"?>
<Rsop xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.microsoft.com/GroupPolicy/Rsop">
<ReadTime>2013-05-06T13:28:17.1529206Z</ReadTime>
<DataType>LoggedData</DataType>
</Rsop>
Anyone here who ever worked with this DLL and can give me some hints?
Thanks in advance!
Cheers

You should execute rsop.CreateQueryResults(), before you generate the report. This requires the LoggingMode, LoggingUser and LoggingComputer properties to be set.

GPRsop rsop = new GPRsop(RsopMode.Logging, null);
rsop.LoggingMode = LoggingMode.Computer;
rsop.LoggingComputer = Environment.GetEnvironmentVariable("COMPUTERNAME");
rsop.LoggingUser = Environment.UserDomainName + #"\" + Environment.GetEnvironmentVariable("USERNAME");
rsop.CreateQueryResults();
var xml = rsop.GenerateReport(ReportType.Xml);
GPMGMTLib used
GPM gpm = new GPM();
var rsop = gpm.GetRSOP(GPMRSOPMode.rsopLogging, null, 0);
rsop.LoggingFlags = 0x20000;
rsop.LoggingComputer = Environment.GetEnvironmentVariable("COMPUTERNAME");
rsop.LoggingUser = Environment.UserDomainName + #"\" + Environment.GetEnvironmentVariable("USERNAME");
rsop.CreateQueryResults();
object cancel = new GPMAsyncCancel();
var result = rsop.GenerateReport(GPMReportType.repXML, null, out cancel);
string xml = result.Result;

using GPMGMTLib;
GPM groupPolicyManagement = new GPM();
IGPMConstants groupPolicyConstants = groupPolicyManagement.GetConstants();
GPMRSOP rsop = groupPolicyManagement.GetRSOP(groupPolicyConstants.RSOPModeLogging, null, 0);
rsop.LoggingComputer = "MyComputer";
rsop.LoggingUser = "domain\\user";
rsop.CreateQueryResults();
rsop.GenerateReportToFile(groupPolicyConstants.ReportXML, "C:\\Temp\\test.xml");