Application.cfm tips and Tricks Michael Smith President TeraTech, Inc ColdFusion, database & VB custom development and training Presentation copyright TeraTech 2002

TeraTech Speaker Information Who am I? n Michael Smith n President of TeraTech, Inc Rockville MD u u ttWebReportServer, CFXGraphicserver n MDCFUG, CFUN-02, Fusebox Conf n Articles in CFDJ, Fusion Authority n CF_Underground IV Oct 27th u

TeraTech Overview n What is Application.cfm n Directory rules n Error handler n Application, Session and Client variables n Logon and Members only n Application Setup n Security

TeraTech What is Application.cfm n Regular CFM file that is included ONCE at beginning of every request. n Spelt Application.cfm (capital A for Unix) n You could just do a CFINCLUDE at beginning of every template. u Saves coding time

TeraTech Directory Rules n CF will search for Application.cfm starting in current directory of request template. n Moves up directory tree to system root (eg C:/) until it finds one. n Even if you don’t want to use Application.cfm feature have a blank one to save processing time.

TeraTech OnRequestEnd.cfm n OnRequestEnd.cfm is run at end of page request. n Opposite of Application.cfm n Must be in same directory as Application.cfm n Not run after CFABORT

TeraTech Traps n Can not span tags between Application.cfm and OnRequestEnd.cfm

TeraTech Error handling n Always have an error handler in Application.cfm – CFERROR tag n Never display default CF errors - gives out SQL information and template paths n Instead error to admin n Don’t explain why attempt failed n Can turn off for development IPs

TeraTech Error handling code In Application.cfm: In error_exception.cfm <CFMAIL to="#error.MailTo#" subject="ColdFusion Error"> #error.RemoteAddress# #error.Template# #error.DateTime# #error.Diagnostics#

TeraTech Application variables n Global across pages n Setup using CFAPPLICATION tag n Use as application.variablename u Lock your usage u Beware max timeout in CF Admin

TeraTech Session variables n Persistent between pages for ONE user. Use CFAPPLICATION tag: n Use as session.variablename u Lock your usage u Beware max timeout in CF Admin

TeraTech Client variables n Persistent between pages for ONE user. In Application.cfm n Use as client.variablename n Use client variables in place of session variables to avoid locking in CF 5. n Store in a DB, NOT the registry n Use WDDX for a complex variables n Timeout set in CF Admin - Manually test for less than 2 hours

TeraTech Timeouts

TeraTech Members only n Want to protect subdirectories for members only n Check CGI.script_name for directory n Check if user is logged on using client variable n Might also check roles in more complex system.

TeraTech Members Only Code

TeraTech Application Setup n Set request variables for dsn, webroot constants. n Request doesn’t need locking. n Have different versions for development, staging and production servers

TeraTech Application Setup code

TeraTech … More Setup code

TeraTech Caching Data n Store application wide data in memory in application varialbes n Must lock write and reads n Check to see if exists before creating n Query caching is easier to code

TeraTech Caching Data code SQL…

TeraTech Copy Session to Request n Session variables require locking, request do not n Copy session structure to a structure in request scope in application.cfm n Use request variables in code n Update any that are changed n See article How to sidestep locking on MDCFUG /Articles/ RequestVariables.cfm

TeraTech Authentication n Stateless web - any page can call another - this is good for open sites n Hacker pages call your page with false data n Use CGI. HTTP_REFERER to control who calls you n Use CGI. CF_TEMPLATE_PATH application.cfm control what is run. Warning - Can be spoofed by browser

TeraTech Fake form submits n Hacker uses View Source in browser to save your HTML source to their machine n Edits form fields and form action URL and submits to your action page. n Can now change what record is edited or remove fields to generate errors n Can also remove any client side validation including _required fields and JavaScript from CFFORM.

TeraTech Preventing Fake form submits To prevent fake form submits n Check HTTP_REFERER is in your domain

TeraTech Encrypt URLs n One way to protect URLs is to encrypt them on all links, form submits and JavaScript submits. n Use URLEncrypt() and URLDecrypt() functions from CFLib project u n Can decrypt in Application.cfm

TeraTech SQL hacking n URL and Form parameters used in SQL u SELECT * FROM EMP WHERE ID = #USERID# u Extra SQL commands on SQL Server 0FROM%20MyCustomerTable u | VBA functions - shell() on Access u xp_cmdshell in SQL Server

TeraTech SQL hacking prevention n use on all SQL parameters n check for ‘ and | etc in form and url variables in Application.cfm n Encrypt URL Variables

TeraTech Protect CFINCLUDE and CFMODULE files n Don’t let CFINCLUDE and CFMODULE files be run standalone – they may do bad things or generate error messages n Protect using a naming convention/ subdirectory and test in application.cfm of CGI.script_name n Especially important for Fusebox applications with many include files

TeraTech Code to protect CFINCLUDE files n For Fusebox In Application.cfm: n Non-Fusebox – check filename/directory

TeraTech Subnet Auto- Authentication In your application.cfm or header.cfm to be included in every page. Your protected links here Warning - spoofed IP numbers will get around this code

TeraTech Custom Debug info n Variable and structure dump in OnRequestEnd.cfm u Use CF_Dump or CF5 CFDump tags to output all session variables or all cookies, etc. objects.com/docs.cfm?f=cf_dump.htm

TeraTech Session Tracking n Who is logged on now u Keep track of login times to see who’s logged in now, can record activity and determine based on last activity or logoff option u Add userid and session info to a structure in application variable.

TeraTech Back button hacking n Hacker uses back button to view sensitive information from a users browser n Consider disabling back button, especially on logout

TeraTech Datasource password n Don’t put datasource userid and password in CF Admin – if any template is compromised hacker can destroy data n Don’t hardcode in every CFQUERY call n Use request variables in application.cfm and encrypt it

TeraTech Questions n Questions? me at