Certain functions behave in dangerous ways regardless of how they are used. Functions in this category were often implemented without taking security concerns into account.

Use of ASNative function was detected. ASNative is an undocumented function reference list. Developers can use the list to call Flash system functions by using indices into the list. For example, the trace() function can also be referenced as ASNative(100, 4). Since the use of ASNative allows a developer to hide the intended function name, this could indicate a malicious intent. Support for ASNative has been discontinued for Flash Player versions 7 and above. ASNative function can be used by malware developers to hide malicious content from auditors. This may be an indication of potentially malicious activity being performed by the Flash application.
Example:
ASNative(100, 4)("Hi"); //is equivalent to trace("Hi");

Certain functions behave in dangerous ways regardless of how they are used. Functions in this category were often implemented without taking security concerns into account.

Certain functions behave dangerously regardless of how they are used. Functions in this category were often implemented without consideration for security.

Example 1: Given the URL http://www.example.com/index.php?param=..., the following snippet of php within index.php will print the value of the URL parameter param (passed in-place of the "...") to the screen if it matches the POSIX regular expression '^[[:alnum:]]*$' representing "zero or more alphanumeric characters":

  <?php
    $pattern = '^[[:alnum:]]*$';
    $string = $_GET['param'];
    if (ereg($pattern, $string)) {
      echo($string);
    }
  ?>

While Example 1 operates as expected with alphanumeric input, because the unsafe ereg() function is used to validate tainted input, it is possible to carry out a cross-site scripting (XSS) attack via null byte injection. By passing a value for param containing a valid alphanumeric string followed by a null byte and then a <script> tag (e.g. "Hello123%00<script>alert("XSS")</script>"), ereg($pattern, $string) will still return true, as the ereg() function ignores everything following a null byte character when reading the input string (left-to-right). In this example, this means that the injected <script> tag following the null byte will be displayed to the user and evaluated.

Certain functions behave in dangerous ways regardless of how they are used. The function xp_cmdshell launches a Windows command shell to execute the provided command string. The command executes either in the default system or a provided proxy context. However, there is no way to limit a user to prespecified set of privileged operations and any privilege grant opens up the user to execute any command string.

The annotation FortifyDangerous has been applied to this method. This is used to indicate that it is dangerous and all uses should be examined for safety.

The annotation FortifyDangerous has been applied to this type. This is used to indicate that it is dangerous and all uses should be examined for safety.