Dave can input malicious field Jee can bypass the centralized Jason can bypass the centralized Jan can craft special payloads to names or data because it is not encoding routines since they are validation routines since they are foil input validation because the being checked within the context not being used everywhere, or the not being used on all inputs character set is not of the current user and process wrong encodings are being used specified/enforced, or the data is encoded multiple times, or the data is not fully converted into the same format the application uses (e.g. canonicalization) before being validated, or variables are not strongly typed 8 9 10 J Data Data Data Data Sarah can bypass the centralized Shamun can bypass input can exploit the trust the Dennis has control over input sanitization routines since they validation or output validation application places in a source of validation, output validation or Validation Validation Validation Validation are not being used checks because validation failures data (e.g. user-definable data, output encoding code or routines comprehensively are not rejected and/or sanitized manipulation of locally stored so they can be bypassed data, alteration to state data on a client device, lack of verification of identity during data validation such as can pretend to be Colin) & & & & Encoding Encoding Encoding Encoding Q K &
Dave can input malicious field names or data because it is not being checked within the context of the current user and process Jee can bypass the centralized encoding routines since they are not being used everywhere, or the wrong encodings are being used Jason can bypass the centralized validation routines since they are not being used on all inputs Jan can craft special payloads to foil input validation because the character set is not specified/enforced, or the data is encoded multiple times, or the data is not fully converted into the same format the application uses (e.g. canonicalization) before being validated, or variables are not strongly typed Data Validation & Encoding 8 Data Validation & Encoding 9 Data Validation & Encoding 10 Data Validation & Encoding J Sarah can bypass the centralized sanitization routines since they are not being used comprehensively Shamun can bypass input validation or output validation checks because validation failures are not rejected and/or sanitized can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity during data validation such as can pretend to be Colin) Dennis has control over input validation, output validation or output encoding code or routines so they can be bypassed Q & K
20160629145452%21OWASP-Cornucopia-Ecommerce_Website.docx