new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

input_validation/implementation

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Input validation implementation techniques

Input validation can be implemented using: data type validators available natively in web application frameworks (such as Django Validators, Apache Commons Validators); validation against JSON Schema and XML Schema (XSD) for input in these formats; type conversion (e.g. Integer.parseInt() in Java, int() in Python) with strict exception handling; minimum and maximum value range check for numerical parameters and dates, minimum and maximum length check for strings; array of allowed values for small sets of string parameters; regular expressions for structured data covering the whole input string (^...$) and not using any character wildcard (such as . or \S); denylisting as additional layer to supplement allowlisting.

Drop-down and radio button validation requirement

If the input field comes from a fixed set of options like a drop down list or radio buttons, the input needs to match exactly one of the values offered to the user in the first place. Any failure to validate a value against this discrete list of options on the server side is a high security event and should be logged as a high severity event as it indicates an attacker is tampering with the client-side code.

Server-side validation is mandatory

Input validation must be implemented on the server-side before any data is processed by an application's functions. JavaScript-based input validation performed on the client-side can be circumvented by an attacker who disables JavaScript or uses a web proxy.

Client-side and server-side validation combined approach

Implementing both client-side JavaScript-based validation for UX and server-side validation for security is the recommended approach, leveraging each for their respective strengths.

Give your agent this brain