This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Cornucopia - Ecommerce Website - VE 9
Suit: Data Validation and Encoding
Card/Value: 9
Description:
Shamun can bypass input validation or output validation checks because validation failures are not rejected and/or sanitized.
Technical Note:
Extensive checks and validations can be made of inputs and outputs, but proper actions following the results is what provides security. Data sanitization is a good approach for outputs, as this data is already accepted by the system. Failing input validation always needs to result in rejection. It is also useful to log (associated with the user's identity if possible) and flag these as probably malicious activity for further analysis, or as input for application intrusion detection systems.
NB: Unlike other cards in this suit, VE 9 assumes that input and output validation checks are in place, however they do not correctly respond to incorrect input.
References:
| OWASP SCP | OWASP ASVS | OWASP AppSensor | CAPEC | SAFECODE |
|---|---|---|---|---|
| 6 | 5.3 | IE2 | 28 | 3 |
| 21 | IE3 | 16 | ||
| 22 | 24 | |||
| 168 |
