I am watching a training video called "Creating Secure J2EE Code". The video makes this statement:
Perform all validation in a secure context on the server. Do not rely on client-side validation as a security mechanism. Validate all application input, including user input, API return values, environment variables, configuration files, and other applications.
Validating environment variables and config files is a new concept to me. Can you please provide a high level overview of what this might look like?
My thoughts are to treat both Environment Variables and Config files similar to user input. I would:
- Sanitize it,
- Test Length (Min & Max),
- Test Range,
- Test format
- Test type (int, decimal, char, etc)
I am assuming config files would contain Key/Value pairs. Im not certain how to handle a configuration file that may contain any other format.
Am I on the right track?