This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
CRV2 FrameworkSpecIssuesASPNet
ASP.NET Security
Input validation Input
Anything coming from external sources can be consider as input in a web application. Not only the user inserting data through a web form, but also data retrieved from a web service or database, headers sent from the browsers fall under this concept.
Defining what is known as trust boundary can help us to visualize all possible untrusted inputs. ASP.NET has different types of validations depending on the level of control to be applied. By default, web pages code is validated against malicious users. The following is a list types of validations used (MSDN, 2013):
| Type of validation | Control to use | Description | ||||||||||||
| Required entry | RequiredFieldValidator | Ensures that the user does not skip an entry. For details, see How to: Validate Required Entries for ASP.NET Server Controls. | Comparison to a value | CompareValidator | Compares a user's entry against a constant value, against the value of another control (using a comparison operator such as less than, equal, or greater than), or for a specific data type. For details, see How to: Validate Against a Specific Value for ASP.NET Server Controls and How to: Validate Against a Data Type for ASP.NET Server Controls. | Required entry | DD | FF | Required entry | DD | FF | Required entry | DD | FF |
A way of defining when input is safe can be done through defining a trust boundary.
