Questions tagged [data-validation]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
41 views

Is it possible to crack a CRC value for short text validation when someone tries to change a readable text?

I'd like to validate message texts with CRC-8/16/32 but I'm afraid that they could be changed to another one (for example, adding a "No" at the beginning). There will be no special characters besides ...
-1
votes
1answer
41 views

Validation issue in name field causes the page to hang

I am using a webpage that doesn't have validation for name field. If I give any special characters, the page just becomes unresponsive. Though the captcha times out after some time, the request still ...
0
votes
1answer
44 views

Is there any security risk with having incomplete data between information systems

I was wondering if there would be any security vulnerabilities with having insufficient data for different employees in a cluster of systems. If an economic system would have incomplete or null fields,...
1
vote
1answer
95 views

What to take into account when validating file upload

One of the key security mechanisms for application software is input validation, which can protect the integrity of the system and thwart common injection and denial of service attacks. Most of the ...
6
votes
2answers
169 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
1
vote
2answers
153 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
0
votes
1answer
47 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
1
vote
1answer
37 views

Should untrusted strings be sanitized server-side if they're inserted into the document body through document.createTextNode?

Chat webapp. Clients (that is, web browsers) send messages to the server, which the server broadcasts to all connected clients. Client-side code looks like this: let p = document.createElement('p') p....
2
votes
1answer
34 views

Can PFS be used to prove that a file was transmitted/received at a particular date & time?

Can Perfect Forward Secrecy (PFS) be used to prove that a particular file was transmitted or received at a particular time? If so, how? By keeping records of the entire TLS stream?
2
votes
1answer
40 views

How to secure a web service that allows custom user defined paths?

I'm working on a website that will rebuild data as an RSS feed based on a custom path. For example: You have a video on youtube that you want an rss feed of comments, you can add -rss to the url (...
2
votes
2answers
102 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
3
votes
2answers
73 views

The proper way to validate user inputs

I am currently building an multiplayer application game on Android, and the server-side logic is deployed using Cloud Functions, which is a server-less environment. The application logic is as follows:...
2
votes
1answer
113 views

Is RMI considered untrusted input even with TLS?

If an application has an RMI API that's used internally (servers communicating with one another), is the information coming from those calls considered trusted or validation is still required? I can'...
23
votes
5answers
8k views

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

An interesting feature of HTML5 is the <input pattern="" /> attribute, which allows the browser to validate the input field's value against a regular expression provided by the developer. ...
3
votes
2answers
2k views

What is at risk if I do not validate Confirm Password on server side and only perform this validation on client side?

While changing password, in my application I am performing only JS validation for password and confirm password field values. It is recommended to have server side validations. But confirm password ...
8
votes
2answers
5k views

Can a CSV contain malicious code?

I am working with a system that allows users to upload CSV files, that are downloaded by other users. The system validates (amongst other things) that all CSV files can be parsed by an RFC 4180 ...
5
votes
5answers
3k views

How to validate user input

I am having a lot of trouble understanding where I as a developer can validate the data that my users send to me. Let's say for a simple example I have a web page where it has a simple form that ...
0
votes
1answer
108 views

Proof of data possesion in cloud storage where you cant do calculation to the object stored in the server

I was looking into some papers regarding proof of data possession like this or thisin cloud storage where you can ask for the proof of the data stored in the cloud storage by giving some kind of ...
5
votes
2answers
621 views

Does git commit hash prove the history until that point?

I have some data and want to prove it's integrity during time, i.e. prove that a certain state of the data was present a a certain date. For this reason I commit the data to a git repository I keep ...
1
vote
3answers
829 views

Is it legal/ethical to release commercial software with known security flaws

I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited. A logged in ...
0
votes
0answers
46 views

Considerations for securly handling zip archives

I'm working with a system that allows people to upload files to be downloaded by others. At the moment, we only accept CSV files with specific columns (and we validate all data uploaded), but there is ...
1
vote
1answer
593 views

Why does it not cause a buffer overflow when a large string is validated for length?

I know that many buffer overflow attacks on servers are conducted by sending very large input strings through some HTML form etc.. The go-to mitigation technique for this, is to validate the length of ...
9
votes
1answer
368 views

Feasibility and scalability of a large biometric system (e.g. Aadhaar)

Over the last five years, India has systematically advanced a biometric identification scheme, which now has an enrollment of over 800 million users. To ensure the accuracy of matching for such a ...
1
vote
2answers
1k views

Difference between information flow control, data flow integrity, and tainting

The three techniques/concepts are frequently mentioned in recent academic security papers. But what are the similarity, difference and relation between them. Below is my very shallow understanding: ...
31
votes
5answers
4k views

Safe email validation

I have been using this RFC822-compliant regular expression for email validation. Pen testers on HackerOne have used the following horrendous email addresses which satisfy the regex: '/**/OR/**/1=1/**/...
0
votes
0answers
394 views

Is keeping business data in browser database websql secure?

Knowing that Server always validates the data before saving it. Browser app is generating the data based on user input and some business logic and is storing it locally. Browser app then synchronize ...
3
votes
1answer
999 views

Uncontrolled Format String Vulnerability in JavaScript

I have been working on input validation vulnerabilities and very new to Uncontrolled Format String Vulnerabilities, as I learned so far its usually exploited through printf functions with "%". I ...
5
votes
3answers
257 views

Input validation: how to do it if I must accept HTML as part of my input?

I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure human-...
0
votes
3answers
3k views

The purpose of escaping html entities

By security principles, we are often taught to sanitize input fields for characters such as & or ' so that they cannot be used for SQL injections etc. However, now I have an issue: I really need ...
30
votes
4answers
67k views

Which is the best way to sanitize user input in PHP?

What is the best way to sanitize user input? These are things I do when users submit data: substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users ...