You MUST take precautions like adding code to verity the mime type after an upload as discussed by Peter Freitag in this post: our case, the hacker was able to upload an file that provided them with COMPLETE control of our server (I'll send you the hackers page if you'd like -- it is truly impressive).They were able to install trojans that, among other things, would email China with our username and password every time we logged onto the server.Meet your driver: Dan Livingston, Action Scripter to the stars (Apple, Charles Schwab, Pac Bell…) Watch, do, learn–fast: - forms and validation, styles and skins - data in detail, XML and RSS - classes and objects, events and listeners - menu systems, stylesheets, masks, preloaders - Action Script 2.0 architecture, new UI components, and loads more All with no-faking, real-deal, serious downloadable code Updated to cover Flash MX, the newest version of Macromedia Flash, Action Script for Flash MX: The Definitive Guide, Second Edition is the one book no serious Flash developer should be without.
Data from the client should never be trusted for the client has every possibility to tamper with the data.
In many cases, Encoding has the potential to defuse attacks that rely on lack of input validation.
In Java, when you create your XML transformation via XSL you can pass in values that are defined in the top of the XSL document like so: Which means I can use that variable later on in my XSL stylesheet – the primary example being being able to pass in the root URL of your application, so you can build links from it, so regardless of where you run this XSL stylesheet, you know images and links will still be relative to the root.
(Admitedly there are other ways to do this, but this is just an example).
To ensure that the application is robust against all forms of input data, whether obtained from the user, infrastructure, external entities or database systems. This weakness leads to almost all of the major vulnerabilities in applications, such as Interpreter Injection, locale/Unicode attacks, file system attacks and buffer overflows.