All geek questions in one place

Can data types other than strings be potentially dangerous if they are obtained from external sources?

It is well known that you cannot trust user inputs. These inputs can even be a security issue if they are used without filtering. XSS and SQL injections are possible problems that arise when using unfiltered user input (or input that can be modified by the user).

To avoid such problems, you must control all the lines that external resources may affect. Perl supports this with "taint-mode".

The problems that I know about are related to manipulated strings. Do you know examples of security issues coming from ints, floats, etc., driven by external influences? Or can these data types be safe?

+3
source share
4 answers

Ultimately, all values ​​are passed as strings to your program, regardless of whether you ultimately convert them or not. Everything should be considered as potentially dangerous, and not just for this reason.

, , . , , . , , , , , - . , , . , ASP.NET, , , , , .

, , , , , .

+4

, , . () , , , , , , . , , , .

+1

, - .

, - (SQL ). , .

, , - , , - " ".

+1

, trust boundary.

, . , , , .

, -

Microsoft (SDL) Blog, ( ) Threat , " PlaySound" , , .

+1

Source: https://habr.com/ru/post/1705573/

More articles:


All Articles