Re: Canonicalization

[exon <exon () home se>]

Peter Conrad wrote:
> Hi,
>
> On Thu, Apr 20, 2006 at 10:22:18PM -0400, Rossen Raykov wrote:
>
> > Is that ?simplest form? achievable? One can perform many and different 
> > encodings making the task of decoding them very difficult and resource 
> > consuming. Usually it is cheaper and safeties to do semantic checkup and 
> > treat the input as erroneous if it does not confirm to the expected 
> > input format.
>
>
> you're comparing apples with oranges here. You must perform canonicalization
> *before* you can match the input against the expected format.
>
>
> > For example if you are expecting number anything different than a number 
> > is error.
>
>
> Here are some different representations of the same number:
>
> 11
> +11
> 11.0
> 11.00
> 011


This is just stupid. If the user is supposed to input an unsigned 
numeric integer it's just dumb to accept dots, plusses, commas and any 
other char than what fits in 0-9. Leading zeros can be stripped, 
although if the application itself never adds them you shouldn't allow 
that either. Even if you accept negative numbers or floating point 
numbers there's still a very limited range of characters to accept.

All user data that's truly free-form should never have any impact on the 
program's behaviour and should thus pass through unmolested and 
unvalidated. This is OK so long as the author knows about it (free-form 
data designated for use in database queries are *not* free-form).

Most web-application security holes come from programmers attempting too 
much dwimmery, making not only the application slower and more 
cumbersome to maintain, but also significantly less secure. 
Userfriendliness should be mainly in error-messages, not in logic code.

/exon

-------------------------------------------------------------------------
This List Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Web Application Attack!" 
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world 
examples of recent hacking methods such as: SQL Injection, Cross Site 
Scripting and Parameter Manipulation

https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------