We Keep Coding

How to SAFELY invoke java keytool from C# code [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.
Closed last year.
Improve this question
I want to create a GUI in C# that will be used to run keytool on cmd.exe behind the scenes to create a keystore, including a key, and certificate data.
Input data then requires
Keystore path
Password
Key alias
Key password
Validity
Certificate info (cn, ou, o, l, st and c)
Unfortunately people may type special characters in their passwords and also space is allowed in the certificate info.
Overall I am worried someone may input some information somewhere that can result in a disastrous command running behind the scenes once this is called (like rm -rf *).
Is there a way to pass a java properties file with the input information to keytool or is there any way that I can safely escape all the data that is passed as string parameters to keytool?
I could not find any type of file that keytool could take, even in separate steps, that would eliminate this issue.
here's the unsafe code (warning: IT'S UNSAFE!!):
using System;
using System.IO;
using System.Diagnostics;
using System.Collections.Generic;
using System.Text.RegularExpressions;
public class AndroidKeystoreCertificateData
{
public string FirstAndLastName;
public string OrganizationalUnit;
public string OrganizationName;
public string CityOrLocality;
public string StateOrProvince;
public string CountryCode;
}
public class AndroidKeystoreData : AndroidKeystoreCertificateData
{
public string KeystorePath;
public string Password;
public string KeyAlias;
public string KeyPassword;
public int ValidityInYears;
}
internal class AndroidUtils
{
private static bool RunCommand(string command, string working_dir, bool show_window = true)
{
using (Process proc = new Process
{
StartInfo =
{
UseShellExecute = false,
FileName = "cmd.exe",
Arguments = command,
CreateNoWindow = !show_window,
WorkingDirectory = working_dir
}
})
{
try
{
proc.Start();
proc.WaitForExit();
return true;
}
catch
{
return false;
}
}
return false;
}
private static string FilterString(string st)
{
return Regex.Replace(st, #"[^\w\d _]", "").Trim();
}
public static string GetKeystoreCertificateInputString(AndroidKeystoreCertificateData data)
{
string strCN = FilterString(data.FirstAndLastName);
string strOU = FilterString(data.OrganizationalUnit);
string strO = FilterString(data.OrganizationName);
string strL = FilterString(data.CityOrLocality);
string cnST = FilterString(data.StateOrProvince);
string cnC = FilterString(data.CountryCode);
string cert = "\"";
if (!string.IsNullOrEmpty(strCN)) cert += "cn=" + strCN + ", ";
if (!string.IsNullOrEmpty(strOU)) cert += "ou=" + strOU + ", ";
if (!string.IsNullOrEmpty(strO)) cert += "o=" + strO + ", ";
if (!string.IsNullOrEmpty(strL)) cert += "l=" + strL + ", ";
if (!string.IsNullOrEmpty(cnST)) cert += "st=" + cnST + ", ";
if (!string.IsNullOrEmpty(cnC)) cert += "c=" + cnC + "\"";
if (cert.Length > 2) return cert;
return string.Empty;
}
private static string GetKeytoolPath()
{
string javaHome = Environment.GetEnvironmentVariable("JAVA_HOME", EnvironmentVariableTarget.User);
return Path.Combine(javaHome, "bin\\keytool");
}
private static string GetKeystoreGenerationCommand(AndroidKeystoreData d)
{
string cert = GetKeystoreCertificateInputString(d);
string keytool = GetKeytoolPath();
string days = (d.ValidityInYears * 365).ToString();
string dname = "-dname \"cn=" + d.KeyAlias + "\"";
if (!string.IsNullOrEmpty(cert)) dname = "-dname " + cert;
string cmd = "echo y | " + keytool + " -genkeypair " + dname +
" -alias " + d.KeyAlias + " -keypass " + d.KeyPassword +
" -keystore " + d.KeystorePath + " -storepass " + d.Password + " -validity " + days;
return cmd;
}
public static bool RunGenerateKeystore(AndroidKeystoreData d)
{
string cmd = GetKeystoreGenerationCommand(d);
string wdir = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
return RunCommand(cmd, wdir, false);
}
}
An example usage would be:
using System;
class MainClass
{
static void Main(string[] args)
{
AndroidKeystoreData d = new AndroidKeystoreData();
d.KeystorePath = "keystorepath";
d.Password = "pass";
d.KeyAlias = "key0";
d.KeyPassword = "pass";
d.ValidityInYears = 25*365;
d.FirstAndLastName = "self";
d.OrganizationalUnit = "my ou";
d.OrganizationName = "my o";
d.CityOrLocality = "my city";
d.StateOrProvince = "my state";
d.CountryCode = "cc";
AndroidUtils.RunGenerateKeystore(d);
}
}
repository | zip file
Additional information on things I tried:
I am in .NET 4.6.2, and I know about CommandLineBuilderExtension, but it's docs starts saying to not use it: This API supports the product infrastructure and is not intended to be used directly from your code.
Xamarin related codebase seems to rely on whatever commandlinebuilderextension does
Looking the CommandLineBuilder.cs source code, I can't tell how well it escapes (it includes a comment on code injection) and what a minimum version of it for only the purpose of the code above would look like.
For now I have a very restrictive regex going on but I don't know if this may be problematic: people with non A-Za-z0-9 characters in their names, if someone wants to use special characters in their passwords and so on. Ideally if there's a way to pass parameters safely through a file, I would prefer. Or alternatively, some way to generate an Android compatible keystore in pure C# without relying in Java keytool.
Bluntely stealing code from MSBuild above I managed to cut things out and come up with something like below, which seems like about right as minimum with a similar enough functionality to be useful.
using System;
using System.Text;
using System.Text.RegularExpressions;
namespace AndroidSignTool
{
public class CommandArgumentsBuilder
{
private StringBuilder Cmd { get; } = new StringBuilder();
private readonly Regex DefinitelyNeedQuotes = new Regex(#"^[a-z\\/:0-9\._\-+=]*$", RegexOptions.None);
private readonly Regex AllowedUnquoted = new Regex(#"[|><\s,;""]+", RegexOptions.IgnoreCase);
private bool IsQuotingRequired(string parameter)
{
bool isQuotingRequired = false;
if (parameter != null)
{
bool hasAllUnquotedCharacters = AllowedUnquoted.IsMatch(parameter);
bool hasSomeQuotedCharacters = DefinitelyNeedQuotes.IsMatch(parameter);
isQuotingRequired = !hasAllUnquotedCharacters;
isQuotingRequired = isQuotingRequired || hasSomeQuotedCharacters;
}
return isQuotingRequired;
}
private void AppendTextWithQuoting(string unquotedTextToAppend)
{
if (string.IsNullOrEmpty(unquotedTextToAppend))
return;
bool addQuotes = IsQuotingRequired(unquotedTextToAppend);
if (addQuotes)
{
Cmd.Append('"');
}
// Count the number of quotes
int literalQuotes = 0;
for (int i = 0; i < unquotedTextToAppend.Length; i++)
{
if (unquotedTextToAppend[i] == '"')
{
literalQuotes++;
}
}
if (literalQuotes > 0)
{
// Replace any \" sequences with \\"
unquotedTextToAppend = unquotedTextToAppend.Replace("\\\"", "\\\\\"");
// Now replace any " with \"
unquotedTextToAppend = unquotedTextToAppend.Replace("\"", "\\\"");
}
Cmd.Append(unquotedTextToAppend);
// Be careful any trailing slash doesn't escape the quote we're about to add
if (addQuotes && unquotedTextToAppend.EndsWith("\\", StringComparison.Ordinal))
{
Cmd.Append('\\');
}
if (addQuotes)
{
Cmd.Append('"');
}
}
public CommandArgumentsBuilder()
{
}
public void AppendSwitch(string switchName)
{
if (string.IsNullOrEmpty(switchName))
return;
if (Cmd.Length != 0 && Cmd[Cmd.Length - 1] != ' ')
{
Cmd.Append(' ');
}
Cmd.Append(switchName);
}
public void AppendSwitchIfNotNull(string switchName, string parameter)
{
if (string.IsNullOrEmpty(switchName) || string.IsNullOrEmpty(parameter))
return;
AppendSwitch(switchName);
AppendTextWithQuoting(parameter);
}
public override string ToString() => Cmd.ToString();
}
}
then the rewritten GetKeystoreGenerationCommand becomes this
public static string GetKeystoreGenerationCommand(AndroidKeystoreData d)
{
string cert = GetKeystoreCertificateInputString(d);
string keytool = "%JAVA_HOME%\\bin\\keytool" ;// GetKeytoolPath();
string days = (d.ValidityInYears * 365).ToString();
if (!string.IsNullOrEmpty(cert)) cert = d.KeyAlias;
var cmd = new CommandArgumentsBuilder();
cmd.AppendSwitch("echo y | " + keytool);
cmd.AppendSwitch("-genkeypair");
cmd.AppendSwitchIfNotNull("-dname", cert);
cmd.AppendSwitchIfNotNull("-alias", d.KeyAlias);
cmd.AppendSwitchIfNotNull("-keypass", d.KeyPassword);
cmd.AppendSwitchIfNotNull("-storepass", d.Password);
cmd.AppendSwitchIfNotNull("-keystore", d.KeystorePath);
cmd.AppendSwitchIfNotNull("-validity", days);
return cmd.ToString();
}

I believe that invoking the keytool binary directly instead of cmd.exe would do the trick if you don't want the user to inject shell commands.

How to do unit test on a method that has StreamReader and Database access

I have never done unit tests before. I'd like to learn how to do it. I'd like to use Visual Studio unit test and moq.
My project is transferring data from interbase to SQL Server. Firstly, I extract data from interbase into a plain text file. The layout is FieldName + some spaces up to 32 char length + field value. Then, I write a method that reads the text file line by line; once it reaches the next record, it inserts the current record into SQL Server.
So it involves in stream reader and SQL database insertion. For the stream reader, I read some post on the Internet and I pass the Stream reader as the method's parameter; but the SQL Server part, I have no idea how to simplify my method so that it can be tested.
I really need your help.
public partial class TableTransfer
{
#region declare vars
public string FirstFldName = "";
public string ErrorMsg = "";
public List<MemoBlobTrio> MemoBlobs = null;
public string SqlServerTableName = "";
#endregion
public bool DoTransfer(System.IO.StreamReader sr, Func<TransferShare, string, string, bool> TransferTable)
{
#region declare var
bool DoInsert = true;
TransferShare transferShare = null;
string line = string.Empty;
string blobLines = string.Empty;
string fldName = string.Empty;
string value = string.Empty;
bool Is1stLine = true;
bool isMemoFld = false;
MemoBlobTrio memoBlobTrio = null;
int idx = 0;
#endregion
try
{
using(sr)
{
transferShare = new TransferShare();
ConnectSQLServer(transferShare);
transferShare.StartInsert(SqlServerTableName);
bool readNext = true;
do
{
try
{
if (readNext)
line = sr.ReadLine();
if ((line != null) && (line.Trim() != ""))
{
fldName = line.Length > 30 ? line.Substring(0, 31).TrimEnd() : "";
Is1stLine = fldName == FirstFldName;
if (Is1stLine)
{
if (DoInsert)
EndInsert(transferShare, line);
else
transferShare.ClearSQL();
DoInsert = true;
}
idx = 0;
isMemoFld = false;
while (idx < MemoBlobs.Count)
{
if (fldName == (MemoBlobs[idx] as MemoBlobTrio).fbFldName)
{
memoBlobTrio = MemoBlobs[idx] as MemoBlobTrio;
line = InsertMemoBlob(transferShare, sr, memoBlobTrio.ssFldName, fldName, memoBlobTrio.fbNextFldName);
readNext = false;
isMemoFld = true;
}
idx++;
}
if (!isMemoFld)
{
if (line.Length > 31)
value = line.Remove(0, 31);
else
value = "";
if (!TransferTable(transferShare, fldName, value))
DoInsert = false;
readNext = true;
}
}
}
catch (Exception err)
{
HandleError(err, line);
}
} while (line != null);
if (DoInsert)
EndInsert(transferShare, line);
}
}
finally
{
transferShare.SQLConn.Dispose();
}
return true;
}
private static void ConnectSQLServer(TransferShare transferShare)
{
TransferShare.SQLServerConnStr = "Data Source=" + Environment.MachineName + "\\SQLEXPRESS;Initial Catalog=MyDB;Integrated Security=True";
transferShare.SQLConn.ConnectionString = TransferShare.SQLServerConnStr;
transferShare.SQLConn.Open();
}
}
public class TransferShare
{
public void StartInsert(string TableName)
{
tableName = TableName;
}
public void EndInsert(TransferShare transferShare, string line)
{
SqlCommand Cmd = null;
try
{
sqlInsFld = sqlInsFld.Remove(sqlInsFld.Length - 1);
sqlInsValue = sqlInsValue.Remove(sqlInsValue.Length - 1);
sqlInsFld = "Insert into " + tableName + " (" + sqlInsFld + ")";
sqlInsValue = " Values (" + sqlInsValue + ")";
Cmd = new SqlCommand(sqlInsFld + sqlInsValue, SQLConn);
Cmd.ExecuteNonQuery();
}
catch (Exception err)
{
throw (new Exception(err.Message));
}
finally
{
sqlInsFld = "";
sqlInsValue = "";
}
}
}

WMI method for returning sql server instances returns empty string

I'm trying to create a WMI method to return all server instances but the GetCorrectWmiNameSpace(); returns an empty string. I use sql server 2012, any idea why is it returning an empty string?
public bool EnumerateSQLInstances()
{
string _instanceName = string.Empty;
string _serviceName = string.Empty;
string _version = string.Empty;
string _edition = string.Empty;
string _correctNamespace = GetCorrectWmiNameSpace();
if (string.Equals(_correctNamespace, string.Empty))
{
return false;
}
string query = string.Format("select * from SqlServiceAdvancedProperty where SQLServiceType = 1 and PropertyName = 'instanceID'");
ManagementObjectSearcher getSqlEngine = new ManagementObjectSearcher(_correctNamespace, query);
if (getSqlEngine.Get().Count == 0)
{
return false;
}
foreach (ManagementObject sqlEngine in getSqlEngine.Get())
{
_serviceName = sqlEngine["ServiceName"].ToString();
_instanceName = GetInstanceNameFromServiceName(_serviceName);
_version = GetWmiPropertyValueForEngineService(_serviceName, _correctNamespace, "Version");
_edition = GetWmiPropertyValueForEngineService(_serviceName, _correctNamespace, "SKUNAME");
}
txtResponse.Text += _serviceName.ToString() + ", " + _instanceName.ToString() + ", " + _version.ToString() + ", " + _edition.ToString();
return true;
}
public static string GetCorrectWmiNameSpace()
{
String wmiNamespaceToUse = "root\\Microsoft\\sqlserver";
List<string> namespaces = new List<string>();
try
{
// Enumerate all WMI instances of
// __namespace WMI class.
ManagementClass nsClass =
new ManagementClass(
new ManagementScope(wmiNamespaceToUse),
new ManagementPath("__namespace"),
null);
foreach (ManagementObject ns in
nsClass.GetInstances())
{
namespaces.Add(ns["Name"].ToString());
}
}
catch (ManagementException e)
{
Console.WriteLine("Exception = " + e.Message);
}
if (namespaces.Count > 0)
{
if (namespaces.Contains("ComputerManagement10"))
{
//use katmai+ namespace
wmiNamespaceToUse = wmiNamespaceToUse + "\\ComputerManagement10";
}
else if (namespaces.Contains("ComputerManagement"))
{
//use yukon namespace
wmiNamespaceToUse = wmiNamespaceToUse + "\\ComputerManagement";
}
else
{
wmiNamespaceToUse = string.Empty;
}
}
else
{
wmiNamespaceToUse = string.Empty;
}
return wmiNamespaceToUse;
}

You will have to modify the method GetCorrectWmiNameSpace() to support later versions of SQL Server, for 2012 and 2014 it will be:
if (namespaces.Count > 0)
{
if (namespaces.Contains("ComputerManagement10"))
{
//use katmai+ namespace
wmiNamespaceToUse = wmiNamespaceToUse + "\\ComputerManagement10";
}
else if (namespaces.Contains("ComputerManagement"))
{
//use yukon namespace
wmiNamespaceToUse = wmiNamespaceToUse + "\\ComputerManagement";
}
else if (namespaces.Contains("ComputerManagement11"))
{
//use 2012 + namespace
wmiNamespaceToUse = wmiNamespaceToUse + "\\ComputerManagement11";
}
else if (namespaces.Contains("ComputerManagement12"))
{
//use 2014 + namespace
wmiNamespaceToUse = wmiNamespaceToUse + "\\ComputerManagement12";
}
else
{
wmiNamespaceToUse = string.Empty;
}
}
Or you can write more flexible code to be prepared for 13, 14 ... etc. versions of SQL Server.
The problem is that you have used code that is meant for SQL Server 2008 and older versions. This method GetCorrectWmiNameSpace() then returns string.Empty even when SQL Server 2012 or 2014 is installed.

Can't read active directory users from IIS, but can read in debugging mode

I have an issue in LDAP with Asp.net IIS application.
I am just reading the user from Active directory, like below,
public class ActiveDirectoryRepository : IActiveDirectoryRepository
{
#region Public methods
List<User> IActiveDirectoryRepository.GetActiveDirectoryUsers(string loginName)
{
List<User> activeDirectoryUsersList = new List<User>();
try
{
string activeDirectory = System.Configuration.ConfigurationManager.AppSettings["EDPUserDomain"];
var searchRoot = new DirectoryEntry(activeDirectory);
var search = new DirectorySearcher(searchRoot);
FormUserSearchFilter(loginName, search);
SearchResultCollection activeDirectoryUsers = search.FindAll();
if (activeDirectoryUsers != null)
{
for (int counter = 0; counter < activeDirectoryUsers.Count; counter++)
{
string userNameEmailString = string.Empty;
SearchResult result = activeDirectoryUsers[counter];
if (result != null && result.Properties.Contains("displayname"))
{
User activeDirectoryUser = new User();
if (result.Properties["givenname"].Count > 0)
{
activeDirectoryUser.FirstName = Convert.ToString(result.Properties["givenname"][0], CultureInfo.InvariantCulture);
}
if (result.Properties["sn"].Count > 0)
{
activeDirectoryUser.LastName = Convert.ToString(result.Properties["sn"][0], CultureInfo.InvariantCulture);
}
if (result.Properties["mail"].Count > 0)
{
activeDirectoryUser.email = Convert.ToString(result.Properties["mail"][0], CultureInfo.InvariantCulture);
}
if (result.Properties["distinguishedname"].Count > 0)
{
string[] domain = Convert.ToString(result.Properties["distinguishedname"][0], CultureInfo.InvariantCulture).Split(',');
if (domain[2] != null)
{
activeDirectoryUser.DomainName = domain[2].Replace("DC=", String.Empty);
}
}
if (result.Properties["samaccountname"].Count > 0)
{
activeDirectoryUser.UserName = Convert.ToString(result.Properties["samaccountname"][0], CultureInfo.InvariantCulture);
}
activeDirectoryUsersList.Add(activeDirectoryUser);
}
}
}
}
catch (Exception ex)
{
string filePath = #"C:\Mails\Error.txt";
using (StreamWriter writer = new StreamWriter(filePath, true))
{
writer.WriteLine("Message :" + ex.Message + "<br/>" + Environment.NewLine + "StackTrace :" + ex.StackTrace +
"" + Environment.NewLine + "Date :" + DateTime.Now.ToString());
writer.WriteLine(Environment.NewLine + "-----------------------------------------------------------------------------" + Environment.NewLine);
}
}
return activeDirectoryUsersList;
}
The above code works well in debugging mode, but it throws the below error after deployed the application in IIS 6.1
Message :An operations error occurred.
<br/>
StackTrace : at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_AdsObject()
at System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne)
at System.DirectoryServices.DirectorySearcher.FindAll()
at PW.EPD.DataAccess.Repository.ActiveDirectoryRepository.PW.EPD.DataAccess.Repository.IActiveDirectoryRepository.GetActiveDirectoryUsers(String loginName)
Date :5/20/2015 11:50:30 PM
-----------------------------------------------------------------------------
Please help me.
Thanks in advance.

Check for System DSN and create System DSN if NOT Existing (iSeries Access ODBC Driver)

can someone please help me with this?
i need to check through the System DSN for my ODBC connection to the AS400 servier and create a System DSN if a particular one does not exist.
i've tried googling and have not been able to find anything good for me.
btw, i am quite new to programming. any help will be much appreciated.
thank you

After going through the few less complicated examples available online, this is what i managed to come up with (and it works fine for me).
using System;
using System.Runtime.InteropServices;
public class ODBC_Manager
{
[DllImport("ODBCCP32.dll")]
public static extern bool SQLConfigDataSource(IntPtr parent, int request, string driver, string attributes);
[DllImport("ODBCCP32.dll")]
public static extern int SQLGetPrivateProfileString(string lpszSection, string lpszEntry, string lpszDefault, string #RetBuffer, int cbRetBuffer, string lpszFilename);
private const short ODBC_ADD_DSN = 1;
private const short ODBC_CONFIG_DSN = 2;
private const short ODBC_REMOVE_DSN = 3;
private const short ODBC_ADD_SYS_DSN = 4;
private const short ODBC_CONFIG_SYS_DSN = 5;
private const short ODBC_REMOVE_SYS_DSN = 6;
private const int vbAPINull = 0;
public void CreateDSN(string strDSNName)
{
string strDriver;
string strAttributes;
try
{
string strDSN = "";
string _server = //ip address of the server
string _user = //username
string _pass = //password
string _description = //not required. give a description if you want to
strDriver = "iSeries Access ODBC Driver";
strAttributes = "DSN=" + strDSNName + "\0";
strAttributes += "SYSTEM=" + _server + "\0";
strAttributes += "UID=" + _user + "\0";
strAttributes += "PWD=" + _pass + "\0";
strDSN = strDSN + "System = " + _server + "\n";
strDSN = strDSN + "Description = " + _description + "\n";
if (SQLConfigDataSource((IntPtr)vbAPINull, ODBC_ADD_SYS_DSN, strDriver, strAttributes))
{
Console.WriteLine("DSN was created successfully");
}
else
{
Console.WriteLine("DSN creation failed...");
}
}
catch (Exception ex)
{
if (ex.InnerException != null)
{
Console.WriteLine(ex.InnerException.ToString());
}
else
{
Console.WriteLine(ex.Message.ToString());
}
}
}
public int CheckForDSN(string strDSNName)
{
int iData;
string strRetBuff = "";
iData = SQLGetPrivateProfileString("ODBC Data Sources", strDSNName, "", strRetBuff, 200, "odbc.ini");
return iData;
}
}
... and then call the methods from your application.
static void Main(string[] args)
{
ODBC_Manager odbc = new ODBC_Manager();
string dsnName = //Name of the DSN connection here
if (odbc.CheckForDSN(dsnName) > 0)
{
Console.WriteLine("\n\nODBC Connection " + dsnName + " already exists on the system");
}
else
{
Console.WriteLine("\n\nODBC Connection " + dsnName + " does not exist on the system");
Console.WriteLine("\n\nPress 'Y' to create the connection?");
string cont = Console.ReadLine();
if (cont == "Y" || cont == "y")
{
odbc.CreateDSN(dsnName);
Environment.Exit(1);
}
else
{
Environment.Exit(1);
}
}
}