The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 2 

■

Core Defense Mechanisms

25

70779c02.qxd:WileyRed  9/14/07  3:12 PM  Page 25

---

Multistep Validation and Canonicalization

A common problem encountered by input-handling mechanisms arises when

user-supplied input is manipulated across several steps as part of the valida-

tion logic. If this process is not handled carefully, then an attacker may be able

to construct crafted input that succeeds in smuggling malicious data through

the validation mechanism. One version of this problem occurs when an appli-

cation attempts to sanitize user input by removing or encoding certain charac-

ters or expressions. For example, an application may attempt to defend against

some cross-site scripting attacks by stripping the expression