Hi all,
I'm about to start work on my second DNN project. The hosting company however is asking to do a security audit of the application. On the audit there are questions like these below. Several of them - there are 27 questions in total - I can answer myself easily, but some of them are more difficult and really are about the core code of DNN. Does anyone know where I can find more information regarding issues like this? I tried e-mailing the general e-mail address (webmaster@dotnetnuke.com) a week ago, but haven't received an answer yet. Thanks in advance!
---
- Database - Authentication: The information used to form the connection strings is stored in a secure location (e.g. this information is stored in the container only).
- Database - Error Handling: Database connections and other limited resources are returned after use (to the pool in case of standard connection pooling of a container is used, or if done by the application itself with configurable parameters like timeouts).
- Application - Checking Input: To prevent cross-site-scripting, SQL injection and other harms, input checking is applied whenever input of any kind (e.g. fields, query strings, cookies or other HTTP headers) is received through any external interface (e.g. from user) with respect to range, length, type, format. The general approach is to check for allowed characters instead of excluding some forbidden ones. If this is not possible, at least escaping of potentially harmful characters has to be done.
---
Best regards,
Stijn Lambert
Winsome Benelux