Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [data-validation]

The tag has no usage guidance.

-1
votes
1answer
41 views

Validation issue in name field causes the page to hang

I am using a webpage that doesn't have validation for name field. If I give any special characters, the page just becomes unresponsive. Though the captcha times out after some time, the request still ...
0
votes
1answer
39 views

Is there any security risk with having incomplete data between information systems

I was wondering if there would be any security vulnerabilities with having insufficient data for different employees in a cluster of systems. If an economic system would have incomplete or null fields,...
1
vote
1answer
74 views

What to take into account when validating file upload

One of the key security mechanisms for application software is input validation, which can protect the integrity of the system and thwart common injection and denial of service attacks. Most of the ...
6
votes
2answers
165 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
1
vote
2answers
152 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
0
votes
1answer
47 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
1
vote
1answer
32 views

Should untrusted strings be sanitized server-side if they're inserted into the document body through document.createTextNode?

Chat webapp. Clients (that is, web browsers) send messages to the server, which the server broadcasts to all connected clients. Client-side code looks like this: let p = document.createElement('p') p....
2
votes
1answer
34 views

Can PFS be used to prove that a file was transmitted/received at a particular date & time?

Can Perfect Forward Secrecy (PFS) be used to prove that a particular file was transmitted or received at a particular time? If so, how? By keeping records of the entire TLS stream?
2
votes
1answer
40 views

How to secure a web service that allows custom user defined paths?

I'm working on a website that will rebuild data as an RSS feed based on a custom path. For example: You have a video on youtube that you want an rss feed of comments, you can add -rss to the url (...
2
votes
2answers
101 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
3
votes
2answers
73 views

The proper way to validate user inputs

I am currently building an multiplayer application game on Android, and the server-side logic is deployed using Cloud Functions, which is a server-less environment. The application logic is as follows:...
2
votes
1answer
107 views

Is RMI considered untrusted input even with TLS?

If an application has an RMI API that's used internally (servers communicating with one another), is the information coming from those calls considered trusted or validation is still required? I can'...
23
votes
5answers
8k views

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

An interesting feature of HTML5 is the <input pattern="" /> attribute, which allows the browser to validate the input field's value against a regular expression provided by the developer. ...
2
votes
2answers
2k views

What is at risk if I do not validate Confirm Password on server side and only perform this validation on client side?

While changing password, in my application I am performing only JS validation for password and confirm password field values. It is recommended to have server side validations. But confirm password ...
7
votes
2answers
4k views

Can a CSV contain malicious code?

I am working with a system that allows users to upload CSV files, that are downloaded by other users. The system validates (amongst other things) that all CSV files can be parsed by an RFC 4180 ...
5
votes
5answers
3k views

How to validate user input

I am having a lot of trouble understanding where I as a developer can validate the data that my users send to me. Let's say for a simple example I have a web page where it has a simple form that ...
0
votes
1answer
106 views

Proof of data possesion in cloud storage where you cant do calculation to the object stored in the server

I was looking into some papers regarding proof of data possession like this or thisin cloud storage where you can ask for the proof of the data stored in the cloud storage by giving some kind of ...
5
votes
2answers
575 views

Does git commit hash prove the history until that point?

I have some data and want to prove it's integrity during time, i.e. prove that a certain state of the data was present a a certain date. For this reason I commit the data to a git repository I keep ...
1
vote
3answers
810 views

Is it legal/ethical to release commercial software with known security flaws

I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited. A logged in ...
0
votes
0answers
43 views

Considerations for securly handling zip archives

I'm working with a system that allows people to upload files to be downloaded by others. At the moment, we only accept CSV files with specific columns (and we validate all data uploaded), but there is ...
1
vote
1answer
548 views

Why does it not cause a buffer overflow when a large string is validated for length?

I know that many buffer overflow attacks on servers are conducted by sending very large input strings through some HTML form etc.. The go-to mitigation technique for this, is to validate the length of ...
9
votes
1answer
361 views

Feasibility and scalability of a large biometric system (e.g. Aadhaar)

Over the last five years, India has systematically advanced a biometric identification scheme, which now has an enrollment of over 800 million users. To ensure the accuracy of matching for such a ...
1
vote
2answers
967 views

Difference between information flow control, data flow integrity, and tainting

The three techniques/concepts are frequently mentioned in recent academic security papers. But what are the similarity, difference and relation between them. Below is my very shallow understanding: ...
31
votes
5answers
4k views

Safe email validation

I have been using this RFC822-compliant regular expression for email validation. Pen testers on HackerOne have used the following horrendous email addresses which satisfy the regex: '/**/OR/**/1=1/**/...
0
votes
0answers
382 views

Is keeping business data in browser database websql secure?

Knowing that Server always validates the data before saving it. Browser app is generating the data based on user input and some business logic and is storing it locally. Browser app then synchronize ...
3
votes
1answer
957 views

Uncontrolled Format String Vulnerability in JavaScript

I have been working on input validation vulnerabilities and very new to Uncontrolled Format String Vulnerabilities, as I learned so far its usually exploited through printf functions with "%". I ...
5
votes
3answers
239 views

Input validation: how to do it if I must accept HTML as part of my input?

I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure human-...
0
votes
3answers
3k views

The purpose of escaping html entities

By security principles, we are often taught to sanitize input fields for characters such as & or ' so that they cannot be used for SQL injections etc. However, now I have an issue: I really need ...
29
votes
4answers
66k views

Which is the best way to sanitize user input in PHP?

What is the best way to sanitize user input? These are things I do when users submit data: substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users ...