| |||||||||||||
Trustworthy input?Trustworthy input?Posted May 23, 2012 12:00 UTC (Wed) by man_ls (subscriber, #15091)In reply to: A Tale of Two Pwnies (Part 1) by mpr22 Parent article: A Tale of Two Pwnies (Part 1) Your statement is harder than it looks: all input is untrustworthy unless proved otherwise.
(Log in to post comments)
Trustworthy input? Posted May 23, 2012 12:16 UTC (Wed) by mpr22 (subscriber, #60784) [Link] Your statement regarding the trustworthiness of input is a true and useful counterpart to my statement about bugs; thank you.
Trustworthy input? Posted May 25, 2012 10:26 UTC (Fri) by bricef (guest, #80336) [Link]
Conclusion: All bugs are security bugs unless your program takes no input.
Trustworthy input? Posted May 25, 2012 10:42 UTC (Fri) by man_ls (subscriber, #15091) [Link] A heuristic refinement of your statement would be: confine processing of user input to a specific module inside your program, and treat bugs in that module as security bugs. The remaining bugs should have lower priority (but they might also be security bugs if the input module doesn't do a good job).
|
|||||||||||||