Read more about this topic in OWASP’s free Cheat Sheets on Input Validation, XSS (Cross Site Scripting) Prevention, DOM-based XSS Prevention, SQL Injection Prevention, and Query Parameterization 4 5 6 7 Data Data Data Data Dave can input malicious data Jee can bypass the centralized Jason can bypass the centralized Jan can craft special payloads to because it is not being checked encoding routines since they are validation routines since they are foil input validation because the Validation Validation Validation Validation within the context of the current not being used comprehensively, not being used comprehensively character set is not user and process or the wrong encodings are being on all inputs specified/enforced, or the data is used for the context encoded multiple times, or the data is not fully converted into the same format the application uses (e.g. canonicalization) before being validated, or variables are & & & & not strongly typed Encoding Encoding Encoding Encoding 8 9 10 J Encoding Data Encoding Data Encoding Data Encoding Data Sarah can bypass the centralized Shamun can bypass input Jerry can exploit the trust the Dennis has control over input sanitization routines since they validation or output validation application places in a source of validation, output validation or Validation Validation Validation are not being used checks because validation failures data (e.g. user-definable data, output encoding code/routines Validation comprehensively are not rejected or sanitized manipulation of locally stored so they can be bypassed data, alteration to state data on a client device, lack of verification of identity such as Jerry can pretend to be Colin) & & & &
Read more about this topic in OWASP’s free Cheat Sheets on Input Validation, XSS (Cross Site Scripting) Prevention, DOM-based XSS Prevention, SQL Injection Prevention, and Query Parameterization Data Validation & Encoding 4 Data Validation & Encoding 5 Data Validation & Encoding 6 Data Validation & Encoding 7 Dave can input malicious data because it is not being checked within the context of the current user and process Jee can bypass the centralized encoding routines since they are not being used comprehensively, or the wrong encodings are being used for the context Jason can bypass the centralized validation routines since they are not being used comprehensively on all inputs Jan can craft special payloads to foil input validation because the character set is not specified/enforced, or the data is encoded multiple times, or the data is not fully converted into the same format the application uses (e.g. canonicalization) before being validated, or variables are not strongly typed Data Validation & Encoding 8 Data Validation & Encoding 9 Data Validation & Encoding 10 Data Validation & Encoding J Sarah can bypass the centralized sanitization routines since they are not being used comprehensively Shamun can bypass input validation or output validation checks because validation failures are not rejected or sanitized Jerry can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity such as Jerry can pretend to be Colin) Dennis has control over input validation, output validation or output encoding code/routines so they can be bypassed
20130225125819%21OWASP-Cornucopia-Ecommerce_Website.docx