<dd id="sga4y"><optgroup id="sga4y"></optgroup></dd>

<nav id="sga4y"><code id="sga4y"></code></nav>

<optgroup id="sga4y"></optgroup>

Input Validation and Representation

Input validation and representation problems ares caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input. The issues include: "Buffer Overflows," "Cross-Site Scripting" attacks, "SQL Injection," and many others.

Contents

ABAP

• Command Injection
• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Denial of Service
• Dynamic Code Evaluation: Code Injection
• Header Manipulation: Cookies
• Log Forging
• Open Redirect
• Path Manipulation
• Process Control
• Resource Injection
• SQL Injection

ActionScript

• Command Injection
• Cross-Site Flashing
• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Dynamic Code Evaluation: Code Injection
• Log Forging
• Open Redirect
• Path Manipulation
• SQL Injection
• Unsafe Reflection

ColdFusion

• ColdFusion Bad Practices: Unauthorized Include
• Command Injection
• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Denial of Service
• Header Manipulation: Cookies
• Log Forging
• Path Manipulation
• Possible Variable Overwrite
• Resource Injection
• SQL Injection
• Setting Manipulation
• XPath Injection

COBOL

• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Reflected
• Header Manipulation
• Log Forging
• Path Manipulation
• Process Control
• Resource Injection
• SQL Injection
• Setting Manipulation

C/C++

• Buffer Overflow
• Buffer Overflow: Format String
• Buffer Overflow: Format String (%f/%F)
• Buffer Overflow: Off-by-One
• Buffer Overflow: Signed Comparison
• Command Injection
• Denial of Service
• Format String
• Illegal Pointer Value
• Integer Overflow
• LDAP Injection
• LDAP Manipulation
• Log Forging
• Out-of-Bounds Read
• Out-of-Bounds Read: Off-by-One
• Out-of-Bounds Read: Signed Comparison
• Path Manipulation
• Process Control
• Resource Injection
• SQL Injection
• Setting Manipulation
• String Termination Error
• String Termination Error(truncate)
• Unsafe Reflection

C#/VB.NET/ASP.NET

• ASP.NET Bad Practices: Unvalidated Web API Model
• Command Injection
• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Dangerous File Inclusion
• Denial of Service
• Dynamic Code Evaluation: Script Injection
• Header Manipulation
• LDAP Injection
• LDAP Manipulation
• Log Forging
• Missing XML Validation
• Missing XML Validation(validating_reader)
• Often Misused: File Upload
• Open Redirect
• Path Manipulation
• Resource Injection
• SQL Injection
• SQL Injection: Castle ActiveRecord
• SQL Injection: LINQ
• SQL Injection: NHibernate
• SQL Injection: SubSonic
• Setting Manipulation
• Unsafe Native Invoke
• Unsafe Reflection
• Value Shadowing
• Value Shadowing: Server Variable
• XML Injection
• XPath Injection

HTML

• HTML5: Form Validation Turned Off
• Often Misused: File Upload

Java/JSP

• ADF Bad Practices: Missing URL Parameter Converter
• Command Injection
• Cross-Site Scripting: DOM
• Cross-Site Scripting: External Links
• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Dangerous File Inclusion
• Denial of Service
• Denial of Service: Parse Double
• Dynamic Code Evaluation: Code Injection
• Hadoop Cluster Manipulation
• Hadoop Job Manipulation
• Header Manipulation
• Header Manipulation: Cookies
• LDAP Injection
• LDAP Manipulation
• Log Forging
• Missing XML Validation
• Often Misused: File Upload
• Open Redirect
• Path Manipulation
• Process Control
• Process Control: Invoker Servlet
• Query String Injection: Amazon Web Services
• Query String Injection: Android Provider
• Resource Injection
• SQL Injection
• SQL Injection: Hibernate
• SQL Injection: JDO
• SQL Injection: Persistence
• SQL Injection: iBatis Data Map
• Setting Manipulation
• Struts 2: Action Field Without Validator
• Struts 2: Duplicate Action Field Validators
• Struts 2: Duplicate Validation Files
• Struts 2: Duplicate Validators
• Struts 2: Undeclared Validator
• Struts 2: Unvalidated Action
• Struts 2: Validation File Without Action
• Struts 2: Validator Without Action Field
• Struts: Duplicate Validation Forms
• Struts: Erroneous validate() Method
• Struts: Form Does Not Extend Validation Class
• Struts: Form Field Without Validator
• Struts: Plugin Framework Not In Use
• Struts: Unused Action Form
• Struts: Unused Validation Form
• Struts: Unvalidated Action Form
• Struts: Validator Turned Off
• Struts: Validator Without Form Field
• Unsafe JNI
• Unsafe Reflection
• XML Injection
• XPath Injection

Javascript

• Cross-Site Scripting: DOM
• Cross-Site Scripting: Poor Validation
• Denial of Service
• Dynamic Code Evaluation: Code Injection
• Header Manipulation
• Open Redirect
• Path Manipulation
• Resource Injection
• SQL Injection

Objective-C

• Format String
• Log Forging
• Path Manipulation
• Resource Injection
• SQL Injection
• Unsafe Reflection

PHP

• Command Injection
• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Dangerous File Inclusion
• Dynamic Code Evaluation: Code Injection
• File Permission Manipulation
• HTTP Parameter Pollution
• Header Manipulation
• Log Forging
• Often Misused: File Upload
• Open Redirect
• Path Manipulation
• Possible Variable Overwrite: Functional Scope
• Possible Variable Overwrite: Global Scope
• Resource Injection
• SQL Injection
• Setting Manipulation
• Unsafe Reflection
• XML Injection
• XPath Injection
• XQuery Injection
• XSLT Injection

Python

• Command Injection
• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Header Manipulation
• Log Forging
• Open Redirect
• Path Manipulation
• Resource Injection
• SQL Injection

PLSQL/TSQL

• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Denial of Service
• Header Manipulation
• Resource Injection
• SQL Injection

VisualBasic/VBScript/ASP

• Command Injection
• Cross-Site Scripting: Persistent
• Cross-Site Scripting: Poor Validation
• Cross-Site Scripting: Reflected
• Dynamic Code Evaluation: Script Injection
• Header Manipulation
• Log Forging
• Open Redirect
• Path Manipulation
• Resource Injection
• SQL Injection
• Setting Manipulation
• Unsafe Reflection

Copyright 2013 Fortify Software - All rights reserved.
(Generated from version 2013.1.1.0008 of the Fortify Secure Coding Rulepacks)