| |||||||||||||
Trustworthy input?Trustworthy input?Posted May 25, 2012 10:26 UTC (Fri) by bricef (guest, #80336)In reply to: Trustworthy input? by mpr22 Parent article: A Tale of Two Pwnies (Part 1)
Conclusion: All bugs are security bugs unless your program takes no input.
(Log in to post comments)
Trustworthy input? Posted May 25, 2012 10:42 UTC (Fri) by man_ls (subscriber, #15091) [Link] A heuristic refinement of your statement would be: confine processing of user input to a specific module inside your program, and treat bugs in that module as security bugs. The remaining bugs should have lower priority (but they might also be security bugs if the input module doesn't do a good job).
|
|||||||||||||