I was looking into this list (top 25 security issues):
That led me to this list:
That led me to wondering how can we code for M2: Establish and maintain control over all of your outputs ?
I understand M1, input validation but output validation? How do we do that?
Does this mean for example, that in a REST API we should validate the response objects we send? If so, What should we do it the validation fails? Do not reply?
I'm probably missing the point here. Thanks for the help. Can someone provide a code (pseudo-code) example?