I was looking into this list (top 25 security issues):

  • https://cwe.mitre.org/top25/index.html#Listing

That led me to this list:

  • https://cwe.mitre.org/top25/index.html#Mitigations

That led me to wondering how can we code for M2: Establish and maintain control over all of your outputs ?

I understand M1, input validation but output validation? How do we do that?

Does this mean for example, that in a REST API we should validate the response objects we send? If so, What should we do it the validation fails? Do not reply?

I'm probably missing the point here. Thanks for the help. Can someone provide a code (pseudo-code) example?

  • In English, "control" does not equal "check" or "validate". The intent of that point sounds more like "make sure you know what your systems are doing to what you are handing off to others for processing". – a CVn Aug 23 '16 at 11:47
  • The "M2" on that page is a clickable link. It takes you to an explanation of what they mean. They are not talking about output validation. – Dan Getz Aug 24 '16 at 11:29

It simply means you should not only check your Inputs (encoding, sql injection, xss, etc) but also you should validate and check your outputs (again for example XSS) so that if your input security mechanisms fail and/or your server sends "garbage" (PHP Error codes presented to the end user for example) you´re still on the safe side.

For example if you got a Web-Application like Twitter, you should not only enforce security checks on inputs by Users (their tweets) but also on the output of your server to users (the tweets of others they see) so that if your input control failed, the output control still recognizes that something went wrong/is a possible threat

IMHO your own link explains everything very well:

  • thanks. I did not get that: Validate our output to make sure it goes as excepted. But are there any guidelines? Frameworks that help with this? And how I know what should be validated? The twitter example you provide, should we validate that the response we send out parses as valid DTO (the right JSON, fields names, types) ? – Vetras Aug 23 '16 at 13:47
  • @Vetras - I don´t think you can say there are "special guidelines", it´s just the same as Input Validation - Is the Output/Input legit? - Is the Output/Input what a expect it to be? - Is the Output/Input harmful or can it be harmful in anyway? - etc. – architekt Aug 23 '16 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.