Category:WASS Validate Inputs - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textacelsitcord.com

2009-05-27T18:27:52Z

Reverting to last version not containing links to www.textacelsitcord.com

Deleted user at 18:57, 21 May 2009

2009-05-21T18:57:27Z

MikeAndrews at 04:24, 19 May 2006

2006-05-19T04:24:35Z

New page

== Validate user inputs ==

User inputs are the life-blood of any applications, but are also the vector for most attacks. Care must be taken therefore in validating any inputs and restricting their usage.

#The application must take steps to validate data by restricting inputs to expected characters only. Specifically…
##Any inputs that can be controlled by the user shall have no effect on the intended meaning of SQL or XML queries which utilize their values.
##The application will not pass off to external systems any user-controlled inputs that have not been validated to have unintentional side-effects
## Where the application is “unmanaged” (i.e. '''not''' Java, .NET), inputs should be truncated at a necessary length so as not to cause buffer overflow vulnerabilities
##Where users are able to upload files into the application, they should be limited to necessary types (e.g. gif, jpeg, etc), checked for malicious content (i.e. Trojans, viruses, etc), and be non-executable (e.g. ASP, EXE, etc)
##Users should not be able to modify input values to see other user’s information, or request resources that they would otherwise not have permissions to access
## Content-Type HTTP Header should be set to a single content type

@@ Line 1: / Line 1: @@
 == Validate user inputs ==
 User inputs are the life-blood of any applications, but are also the vector for most attacks.  Care must be taken therefore in validating any inputs and restricting their usage.
-#The application must take steps to validate data by restricting inputs to expected characters only.  Specificallyâ¦
+#The application must take steps to validate data by restricting inputs to expected characters only.  Specifically…
 ##Any inputs that can be controlled by the user shall have no effect on the intended meaning of SQL or XML queries which utilize their values.
 ##The application will not pass off to external systems any user-controlled inputs that have not been validated to have unintentional side-effects
-## Where the application is âunmanagedâ (i.e. '''not''' Java, .NET), inputs should be truncated at a necessary length so as not to cause buffer overflow vulnerabilities
+## Where the application is “unmanaged” (i.e. '''not''' Java, .NET), inputs should be truncated at a necessary length so as not to cause buffer overflow vulnerabilities
 ##Where users are able to upload files into the application, they should be limited to necessary types (e.g. gif, jpeg, etc), checked for malicious content (i.e. Trojans, viruses, etc), and be non-executable (e.g. ASP, EXE, etc)
-##Users should not be able to modify input values to see other userâs information, or request resources that they would otherwise not have permissions to access
+##Users should not be able to modify input values to see other user’s information, or request resources that they would otherwise not have permissions to access
 ## Content-Type HTTP Header should be set to a single content type