Validate Inputs

Opis

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Wpisy w tej grupie

• CWE-138 Improper Neutralization of Special Elements
• CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
• CWE-20 Improper Input Validation
• CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
• CWE-352 Cross-Site Request Forgery (CSRF)
• CWE-472 External Control of Assumed-Immutable Web Parameter
• CWE-473 PHP External Variable Modification
• CWE-502 Deserialization of Untrusted Data
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• CWE-641 Improper Restriction of Names for Files and Other Resources
• CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
• CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
• CWE-76 Improper Neutralization of Equivalent Special Elements
• CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-790 Improper Filtering of Special Elements
• CWE-791 Incomplete Filtering of Special Elements
• CWE-792 Incomplete Filtering of One or More Instances of Special Elements
• CWE-793 Only Filtering One Instance of a Special Element
• CWE-794 Incomplete Filtering of Multiple Instances of Special Elements
• CWE-795 Only Filtering Special Elements at a Specified Location
• CWE-796 Only Filtering Special Elements Relative to a Marker
• CWE-797 Only Filtering Special Elements at an Absolute Position
• CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
• CWE-91 XML Injection (aka Blind XPath Injection)
• CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• CWE-943 Improper Neutralization of Special Elements in Data Query Logic
• CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
• CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
• CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
• CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')

Źródła