Cornucopia - Ecommerce Website - C 2

Suit: Cornucopia

Card/Value: 2

Description:

Lee can bypass application controls because dangerous/risky programming language functions have been used instead of safer alternatives, or there are type conversion errors, or because the application is unreliable when an external resource is unavailable, or there are race conditions, or there are resource initialization or allocation issues, or overflows can occur.

Technical Note:

This card is framework/language-specific. Examples include:

• Beware of un-trusted data.
• Check buffer sizes.
• Do not rely on garbage collection.
• Use non-executable stacks when available.
• Avoid the use of known vulnerable functions.
• Properly free allocated memory.
• Use checksums or hashes to verify the integrity of interpreted code, libraries, executables, and configuration files.
• Utilize locking to prevent multiple simultaneous requests.
• Use a synchronization mechanism to prevent race conditions.
• Protect shared variables and resources from inappropriate concurrent access.
• Explicitly initialize all your variables and other data store.
• In cases where the application must run with elevated privileges, raise privileges as late as possible, and drop them as soon as possible.
• Make no assumptions about availability of other resources, and handle exceptions.

References:

OWASP SCP	OWASP ASVS	OWASP AppSensor	CAPEC	SAFECODE
194	5.1	-	25	3
195			26	5
196			29	6
197			96	7
198			123	9
199			124	22
200			128	25
201			129	26
202			264	34
205			265
206
207
208
209

« Previous Card | Cornucopia | Next Card »