AuditUnit 5 · Topic 5.5
Input review: which submissions should the sanitizer stop?
Decide which form inputs the sanitizer should stop.
New to this? Read the topic first: 5.5 Protecting Applications.
Simulation · [5.5.B.1, 5.5.B.2, 5.1.B.2]
Input review: which submissions should the sanitizer stop?
These are values typed into the "Order quantity" and "Gift message" fields of an online shop. Quantity should be a whole number from 1 to 20; a gift message is plain text. Tap every input the validation function should reject or sanitize. There are 4.
-
Fine. A whole number between 1 and 20: exactly what the field expects.
-
Red flag. A semicolon is a control character, followed by an SQL command. A number field should accept only digits.
-
Red flag. Digits only, but outside the expected range of 1 to 20. Data validation rejects input outside the expected parameters.
-
Fine. Plain text with ordinary punctuation. Nothing here changes how the program behaves.
-
Red flag. A script tag: if the shop shows this message on a page, every visitor's browser runs it. That is cross site scripting (XSS).
-
Red flag. Single quotes are control characters that can close the application's own quotes, and OR '1'='1 is always true: an SQL injection attempt.
-
Fine. Plain text. Numbers and spaces in a message are normal.
Go to the topic: 5.5 Protecting Applications