Confirmed users
971
edits
Where's My Fox Security Review: Difference between revisions
Jump to navigation
Jump to search
→API Input Validation
| Line 64: | Line 64: | ||
=== API Input Validation === | === API Input Validation === | ||
HIGH RISK - Input validation | HIGH RISK - Input validation should be more structural and part of every handler | ||
Functions like getDevFromUrl() to extract a device identifier from the url do not make an effort to validate the identifier. If we know these identifiers are hex hashes or uuids then I think that code can be stricter by matching them against a regular expression. | Functions like getDevFromUrl() to extract a device identifier from the url do not make an effort to validate the identifier. If we know these identifiers are hex hashes or uuids then I think that code can be stricter by matching them against a regular expression. | ||