Data Validation Issues

Opis

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

Wpisy w tej grupie

• CWE-112 Missing XML Validation
• CWE-179 Incorrect Behavior Order: Early Validation
• CWE-183 Permissive List of Allowed Inputs
• CWE-184 Incomplete List of Disallowed Inputs
• CWE-606 Unchecked Input for Loop Condition
• CWE-641 Improper Restriction of Names for Files and Other Resources
• CWE-1173 Improper Use of Validation Framework
• CWE-1284 Improper Validation of Specified Quantity in Input
• CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
• CWE-1286 Improper Validation of Syntactic Correctness of Input
• CWE-1287 Improper Validation of Specified Type of Input
• CWE-1288 Improper Validation of Consistency within Input
• CWE-1289 Improper Validation of Unsafe Equivalence in Input

Uwagi

<xhtml:p>CWE-20 (Improper Input Validation) is not included in this category because it is a Class level, and this category focuses more on Base level weaknesses. Also note that other kinds of weaknesses besides improper validation are included as members of this category.</xhtml:p>