Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [data-validation]

The tag has no usage guidance.

1
vote
1answer
42 views

What to take into account when validating file upload

One of the key security mechanisms for application software is input validation, which can protect the integrity of the system and thwart common injection and denial of service attacks. Most of the ...
6
votes
2answers
139 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
1
vote
2answers
139 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
0
votes
1answer
40 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
1
vote
1answer
28 views

Should untrusted strings be sanitized server-side if they're inserted into the document body through document.createTextNode?

Chat webapp. Clients (that is, web browsers) send messages to the server, which the server broadcasts to all connected clients. Client-side code looks like this: let p = document.createElement('p') p....
2
votes
1answer
32 views

Can PFS be used to prove that a file was transmitted/received at a particular date & time?

Can Perfect Forward Secrecy (PFS) be used to prove that a particular file was transmitted or received at a particular time? If so, how? By keeping records of the entire TLS stream?
0
votes
0answers
64 views

How to check for malware in existing personal data

tl;dr: Before concentrating on the walls of my walled-garden security model how can I be sure that I don't already have infected plants. Put another way: How can I be sure that I'm not compromising ...
2
votes
1answer
40 views

How to secure a web service that allows custom user defined paths?

I'm working on a website that will rebuild data as an RSS feed based on a custom path. For example: You have a video on youtube that you want an rss feed of comments, you can add -rss to the url (...
2
votes
2answers
96 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
3
votes
2answers
72 views

The proper way to validate user inputs

I am currently building an multiplayer application game on Android, and the server-side logic is deployed using Cloud Functions, which is a server-less environment. The application logic is as follows:...
2
votes
1answer
95 views

Is RMI considered untrusted input even with TLS?

If an application has an RMI API that's used internally (servers communicating with one another), is the information coming from those calls considered trusted or validation is still required? I can'...
23
votes
5answers
8k views

Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?

An interesting feature of HTML5 is the <input pattern="" /> attribute, which allows the browser to validate the input field's value against a regular expression provided by the developer. ...
1
vote
2answers
1k views

What is at risk if I do not validate Confirm Password on server side and only perform this validation on client side?

While changing password, in my application I am performing only JS validation for password and confirm password field values. It is recommended to have server side validations. But confirm password ...
6
votes
2answers
3k views

Can a CSV contain malicious code?

I am working with a system that allows users to upload CSV files, that are downloaded by other users. The system validates (amongst other things) that all CSV files can be parsed by an RFC 4180 ...
5
votes
5answers
2k views

How to validate user input

I am having a lot of trouble understanding where I as a developer can validate the data that my users send to me. Let's say for a simple example I have a web page where it has a simple form that ...
0
votes
1answer
106 views

Proof of data possesion in cloud storage where you cant do calculation to the object stored in the server

I was looking into some papers regarding proof of data possession like this or thisin cloud storage where you can ask for the proof of the data stored in the cloud storage by giving some kind of ...
0
votes
0answers
23 views

Scheme for ensuring integrity of Field Upgradable features in generic widget

Let's say that I want to manufacture generic widgets (hardware products with a small microcontroller connected to a TPM module with an unsecure communication bus). At manufacturing time, I can assign ...
5
votes
2answers
492 views

Does git commit hash prove the history until that point?

I have some data and want to prove it's integrity during time, i.e. prove that a certain state of the data was present a a certain date. For this reason I commit the data to a git repository I keep ...
0
votes
0answers
25 views

What are the risks/are there techniques of using the sender's MAC to modify a common session key for validation purposes?

I'm looking at group communication within a group of clients where a shared common session key has already been pre-established for ciphering purposes. In order to enable validation of the sender, ...
1
vote
3answers
665 views

Is it legal/ethical to release commercial software with known security flaws

I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited. A logged in ...
0
votes
0answers
40 views

Considerations for securly handling zip archives

I'm working with a system that allows people to upload files to be downloaded by others. At the moment, we only accept CSV files with specific columns (and we validate all data uploaded), but there is ...
1
vote
1answer
390 views

Why does it not cause a buffer overflow when a large string is validated for length?

I know that many buffer overflow attacks on servers are conducted by sending very large input strings through some HTML form etc.. The go-to mitigation technique for this, is to validate the length of ...
9
votes
1answer
346 views

Feasibility and scalability of a large biometric system (e.g. Aadhaar)

Over the last five years, India has systematically advanced a biometric identification scheme, which now has an enrollment of over 800 million users. To ensure the accuracy of matching for such a ...
1
vote
2answers
812 views

Difference between information flow control, data flow integrity, and tainting

The three techniques/concepts are frequently mentioned in recent academic security papers. But what are the similarity, difference and relation between them. Below is my very shallow understanding: ...
30
votes
5answers
4k views

Safe email validation

I have been using this RFC822-compliant regular expression for email validation. Pen testers on HackerOne have used the following horrendous email addresses which satisfy the regex: '/**/OR/**/1=1/**/...
0
votes
0answers
354 views

Is keeping business data in browser database websql secure?

Knowing that Server always validates the data before saving it. Browser app is generating the data based on user input and some business logic and is storing it locally. Browser app then synchronize ...
3
votes
1answer
835 views

Uncontrolled Format String Vulnerability in JavaScript

I have been working on input validation vulnerabilities and very new to Uncontrolled Format String Vulnerabilities, as I learned so far its usually exploited through printf functions with "%". I ...
5
votes
3answers
209 views

Input validation: how to do it if I must accept HTML as part of my input?

I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure human-...
0
votes
3answers
3k views

The purpose of escaping html entities

By security principles, we are often taught to sanitize input fields for characters such as & or ' so that they cannot be used for SQL injections etc. However, now I have an issue: I really need ...
28
votes
4answers
63k views

Which is the best way to sanitize user input in PHP?

What is the best way to sanitize user input? These are things I do when users submit data: substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users ...