Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-10-06 07:06:54 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Add security knowledge: validate unauthenticated endpoint responses

Browse source 
New remedial article for spotting when AL calls an endpoint that does not
authenticate itself to the client (bare HttpClient.Get, blank SOAP SecretText,
post-DisableHttpsCheck HTTP) and requires the response to be size-, schema-, and
request/response-integrity-validated before it is trusted. Includes the
BC-specific false-positive clarifications (platform buffers the full body, so an
in-AL size check after buffering is correct; no DNS-rebinding/bounded-read demand;
HTTPS not always enforceable) plus good/bad AL samples.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Djordje Cenic 2026-09-15 13:16:53 +02:00
parent 841b4e7cab
commit 2c45021cb3
3 changed files with 91 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

46
microsoft/knowledge/security/validate-unauthenticated-response-before-use.good.al Normal file
View file

@ -0,0 +1,46 @@
codeunit 50540 "Sec Sample UnauthResp Good"
{
// The public VAT validation service does not authenticate itself to us (no OAuth, no
// certificate, plain HTTP), so its response must be validated before it is trusted.
procedure IsVatNumberValid(RequestedCountryCode: Text; RequestedVatNumber: Text): Boolean
var
HttpClient: HttpClient;
Response: HttpResponseMessage;
JsonResponse: JsonObject;
JsonToken: JsonToken;
Content: Text;
ResponseCountryCode: Text;
ResponseVatNumber: Text;
begin
HttpClient.Get('http://vat-service.example/check?cc=' + RequestedCountryCode + '&vat=' + RequestedVatNumber, Response);
if not Response.IsSuccessStatusCode() then
exit(false);
Response.Content().ReadAs(Content);
// 1) Size cap - the platform already buffered the whole body; reject abnormally large payloads.
if StrLen(Content) > 4096 then
Error('The VAT validation response exceeded the maximum allowed size and was rejected.');
// 2) Schema - require the expected scalar fields, not just a truthy flag.
if not JsonResponse.ReadFrom(Content) then
Error('The VAT validation response was not in the expected format and was rejected.');
if not JsonResponse.Get('countryCode', JsonToken) then
Error('The VAT validation response did not include the requested identifiers and was rejected.');
ResponseCountryCode := JsonToken.AsValue().AsText();
if not JsonResponse.Get('vatNumber', JsonToken) then
Error('The VAT validation response did not include the requested identifiers and was rejected.');
ResponseVatNumber := JsonToken.AsValue().AsText();
// 3) Integrity - the echoed identifiers must match the request, so a valid=true payload
// with the identifiers stripped cannot be accepted for an arbitrary VAT number.
if (UpperCase(ResponseCountryCode) <> UpperCase(RequestedCountryCode)) or
(UpperCase(ResponseVatNumber) <> UpperCase(RequestedVatNumber))
then
Error('The VAT validation response did not match the requested identifiers and was rejected.');
if not JsonResponse.Get('valid', JsonToken) then
exit(false);
exit(JsonToken.AsValue().AsBoolean());
end;
}