Weekly Edition
Return to the Security page
| |||||||||||||
Secure programmer: Validating input (IBM developerWorks)
David A. Wheeler writes
about validating input in this installment of the Secure Programmer, on
IBM developerWorks. "One of the biggest mistakes developers of
secure programs make is to try to check for 'illegal' data values. It's a
mistake because attackers are quite clever; they can often think of yet
another dangerous data value. Instead, determine what is legal, check if
the data matches that definition, and reject anything that doesn't match
that definition. For security it's best to be extremely conservative to
start with, and allow just the data that you know is legal. After all, if
you're too restrictive, users will quickly report that the program won't
allow legitimate data to be entered. On the other hand, if you're too
permissive, you may not find that out until after your program has been
subverted."
(Log in to post comments)
|
|||||||||||||