+CON.10.A8 Comprehensive Input Validation and Output Encoding (B)

CON.10.A8 Comprehensive Input Validation and Output Encoding (B)

Developers MUST treat all data passed to a web application as potentially dangerous and filter it appropriately. All input data, as well as data streams and secondary data (such as session IDs), MUST be validated on the server side.

The automatic handling of erroneous input SHOULD be minimised (through sanitising) to the greatest extent possible. If it is unavoidable, sanitising MUST be implemented securely.

Output data MUST be encoded so that malicious code is not interpreted or executed on the target system.

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai

Susietos užduotys

Saitai
blocks G 0.28 Software Vulnerabilities or Errors