Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

  1. Every access to backend systems such as databases MUST be parameterized7, e.g. via
    prepared statements, OR mappers (e.g. Hibernate) when an API for this matter do exist.

  2. All parameters, either internally or user-controlled, MUST be declared as parameters within
    a prepared statement (or similar API) call.

  3. In case an API does not provide any methods for parameterized statements, parameters
    MUST be encoded with suitable APIs (e.g. SQL encoding) to prevent interpreter injection.

  4. User-controlled parameters MUST be encoded with a suitable API and method related to
    its output context if written to an HTML page:
    a) HTML Context: HTML entity encoding
    b) JavaScript Context: JavaScript escaping
    c) CSS Context: CSS escaping

  5. Output encoding SHOULD only be implemented with mature APIs and frameworks.

  6. Implicit validation (e.g. via ORM frameworks or template technologies) SHOULD be
    preferred to explicit validation (API calls).

  • No labels