Secure Coding mailing list archives

Some Interesting Topics arising from the SANS/CWE Top 25

From: fw at deneb.enyo.de (Florian Weimer)
Date: Wed, 14 Jan 2009 20:57:45 +0100

* Johan Peeters:

while I am being persuaded that you can use input validation and
output encoding interchangeably


Interchangeably?  Hardly.

as countermeasures for *some* problems documented here, there is
another important dimension: enforcement of business rules. In this
domain, I do not see an alternative to input validation.


What is a business rule? Something like "If the customer has changed
the shipment address from a previous order, we must re-request his or
her credit card details"?  How would you implement *that* using input
validation?

Current thread:

Some Interesting Topics arising from the SANS/CWE Top 25 Steven M. Christey (Jan 12)
- Some Interesting Topics arising from the SANS/CWE Top 25 Greg Beeley (Jan 13)
  - Some Interesting Topics arising from the SANS/CWE Top 25 Johan Peeters (Jan 13)
    - Some Interesting Topics arising from the SANS/CWE Top 25 Florian Weimer (Jan 14)
    - Some Interesting Topics arising from the SANS/CWE Top 25 Johan Peeters (Jan 14)
  - Some Interesting Topics arising from the SANS/CWE Top 25 Steven M. Christey (Jan 14)
  - Some Interesting Topics arising from the SANS/CWE Top 25 Ivan Ristic (Jan 14)
    - Some Interesting Topics arising from the SANS/CWE Top 25 Jim Manico (Jan 14)
    - Some Interesting Topics arising from the SANS/CWE Top 25 Brian Chess (Jan 14)
    - Some Interesting Topics arising from the SANS/CWE Top 25 Ivan Ristic (Jan 15)
  - Some Interesting Topics arising from the SANS/CWE Top 25 Joe Teff (Jan 15)
- Some Interesting Topics arising from the SANS/CWE Top 25 Florian Weimer (Jan 14)