Input Validation and Data Sanitization (IDS)
Rules
- IDS00-J. Prevent SQL injection
- IDS01-J. Normalize strings before validating them
- IDS03-J. Do not log unsanitized user input
- IDS04-J. Safely extract files from ZipInputStream
- IDS06-J. Exclude unsanitized user input from format strings
- IDS07-J. Sanitize untrusted data passed to the Runtime.exec() method
- IDS08-J. Sanitize untrusted data included in a regular expression
- IDS11-J. Perform any string modifications before validation
- IDS14-J. Do not trust the contents of hidden form fields
- IDS15-J. Do not allow sensitive information to leak outside a trust boundary
- IDS16-J. Prevent XML Injection
- IDS17-J. Prevent XML External Entity Attacks
Risk Assessment Summary
| Rule | Severity | Likelihood | Detectable | Repairable | Priority | Level |
|---|---|---|---|---|---|---|
| IDS00-J | High | Likely | Yes | No | P18 | L1 |
| IDS01-J | High | Probable | No | No | P6 | L2 |
| IDS03-J | Medium | Probable | No | No | P4 | L3 |
| IDS04-J | Low | Probable | No | No | P2 | L3 |
| IDS06-J | Medium | Unlikely | Yes | No | P4 | L3 |
| IDS07-J | High | Probable | Yes | No | P12 | L1 |
| IDS08-J | Medium | Unlikely | Yes | No | P4 | L3 |
| IDS11-J | High | Probable | No | No | P6 | L2 |
| IDS14-J | High | Probable | No | No | P6 | L2 |
| IDS16-J | High | Probable | Yes | No | P12 | L1 |
| IDS17-J | Medium | Probable | No | No | P4 | L3 |
Attachments:
filter_input.JPG (image/jpeg) filter_output.JPG (image/jpeg) Java IDS.jpg (image/jpeg) Java Injection.jpg (image/jpeg)