Tag Info

New answers tagged

1

You are safe to skip server-side validation for that form providing you truncate excessively large inputs, use parameterized queries, and html encode the data if you ever output it. The accepted answer states that you "should always implement server side validations to prevent attacks". For this particular form, what validations must be implemented that ...


0

There is X.509, and there is SSL/TLS. TLS expects the server to send an X.509 certificate chain, from which the client will extract the server's public key. Then things diverge: In pure X.509, the server should send its certificate for the client to validate; possibly, the server may add an unordered bunch of extra certificates that could prove useful to ...


0

The provided chain should not include the root, if it does the client must disregard it. A key feature of X.509 trust is that it requires pre-known roots (or trust anchors). This isn't the cause of your problem though. The order is inverted, the server cert should be first, followed by its signer (and its signer etc. if need be), this might cause problems on ...


0

Technically yes, there is a very minor data leakage vulnerability here. In your example: "aaaaaafooNfooaaaaaaa".replaceAll("foo([A-Z])foo", "user_input") if user_input contained $1 and the value of the above was output and the input string aaaaaafooNfooaaaaaaa was not user controlled, the user would be able to find out what the original "secret" string ...



Top 50 recent answers are included