8 9 10 J Data Data Data Data Sarah can bypass the centralized Shamun can bypass input Darío can exploit the trust the Dennis has control over sanitization routines since they validation or output validation application places in a source of validation, output validation or Validation Validation Validation Validation are not being used checks because validation failures data (e.g. user-definable data, output encoding code or routines comprehensively are not rejected and/or sanitized manipulation of locally stored so they can be bypassed data, alteration to state data on a client device, lack of verification of identity during data validation such as Darío can pretend to be Colin) & & & & Encoding Encoding Encoding Encoding Q K Data Data Geoff can inject data into a client Gabe can inject data into an (no card) (no card) or device side interpreter because server-side interpreter (e.g. SQL, Validation Validation a parameterised interface is not OS commands, Xpath, Server being used, or has not been JavaScript, SMTP) because a implemented correctly, or the strongly typed parameterised data has not been encoded interface is not being used or has correctly for the context, or there not been implemented correctly is no restrictive policy on code or data includes & & Encoding Encoding
Data Validation & Encoding 8 Data Validation & Encoding 9 Data Validation & Encoding 10 Data Validation & Encoding J Sarah can bypass the centralized sanitization routines since they are not being used comprehensively Shamun can bypass input validation or output validation checks because validation failures are not rejected and/or sanitized Darío can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity during data validation such as Darío can pretend to be Colin) Dennis has control over validation, output validation or output encoding code or routines so they can be bypassed Data Validation & Encoding Q Data Validation & Encoding K Geoff can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly (no card) (no card)
OWASP-Cornucopia-Ecommerce_Website.docx