All untrusted input parameters (e.g. of external interfaces(or if otherwise untrusted) MUST be validated restrictively.
Security-relevant input validation MUST be performed on the server-side. Client-side validation MAY be implemented but only for usability reasons in addition to server-side validation or to prevent client-side attacks.
Input validation MUST SHOULD be performed as strictly as possible in respect of allowed data type, length, and range. Examples:
Numeric instead of a String datatype,
limitations for numeric data types ,restricted String values (e.g. using regexps) or
restricted allowed characters for a string (e.g. only “a-z” and “A-Z”).
Input validation MUST be applied to all types of external untrusted input parameters (including hidden form fields and HTTP header such as cookies).
In order to remove path truncations like “
../../”, directory paths MUST be normalized / before input validation is applied to it[1]. This MAY be done implicitly by using a secure API that removes such truncations automatically.Input validation SHOULD be using a positive validation model (whitelisting).
Input validation SHOULD Validation of user input SHOULD be performed implicitly with data binding (typecasting) or using indirections where possible.
Validation of non-editable application parameters (no user input) SHOULD be performed implicitly via integrity checks or indirection mappings where possible.
HTML input MUST be validated restrictively with a mature HTML sanitizer API.
JSON or XML data from untrusted sources (e.g. received by a service) MUST always be validated indirectly (e.g. via bean validation) or directly via an XML Schema. This MUST be done restrictively as described above.
An XML parser that process XML content from untrusted sources (e.g. from an external entity) MUST be hardened to prevent common XML-based attacks:
Set restrictive limits (e.g. in respect of maximal nesting depth or document size),
deactivate processing of external XML entities.
In order to prevent insecure object deserialization, it MUST be ensured that objects received and bound from untrusted sources are not hostile or tempered (e.g. by only binding non-sensitive attributes, perform whitelisting or integrity checks.
...