The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

“Accept Known Good”

This approach employs a white list containing a set of literal strings or pat-

terns, or a set of criteria, that is known to match only benign input. The vali-

dation mechanism allows data that matches the white list, and blocks

everything else. For example, before looking up a requested product code in

the database, an application might validate that it contains only alphanumeric

Chapter 2 

■

Core Defense Mechanisms

21

70779c02.qxd:WileyRed  9/14/07  3:12 PM  Page 21

---

characters and is exactly six characters long. Given the subsequent processing

that will be done on the product code, the developers know that input passing

this test cannot possibly cause any problems.

In cases where this approach is feasible, it is regarded as the most effective

way of handling potentially malicious input. Provided that due care is taken in

constructing the white list, an attacker will not be able to use crafted input to

interfere with the application’s behavior. However, there are numerous situa-

tions in which an application must accept data for processing that does not

meet any reasonable criteria for what is known to be “good.” For example,

some people’s names contain the apostrophe and hyphen characters. These

can be used in attacks against databases, but it may be a requirement that the

application should permit anyone to register under their real name. Hence,

while it is often extremely effective, the white-list-based approach does not

represent an all-purpose solution to the problem of handling user input.

Sanitization

This approach recognizes the need to sometimes accept data that cannot be

guaranteed as safe. Instead of rejecting this input, the application sanitizes it in

various ways to prevent it from having any adverse effects. Potentially mali-

cious characters may be removed from the data altogether, leaving only what

is known to be safe, or they may be suitably encoded or “escaped” before fur-

ther processing is performed.

Approaches based on data sanitization are often highly effective, and in

many situations they can be relied upon as a general solution to the problem of

malicious input. For example, the usual defense against cross-site scripting

attacks is to HTML-encode dangerous characters before these are embedded

into pages of the application (see Chapter 12). However, effective sanitization

may be difficult to achieve if several kinds of potentially malicious data need

to be accommodated within one item of input. In this situation, a boundary

validation approach is desirable, as described later.