Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application must not be subject to input handling vulnerabilities.
Description
Discussion Text
A common application vulnerability is unpredictable behavior due to improper input validation. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information system responses to the invalid input may be disruptive or cause the system to fail into an unsafe state.
Data received from the user should always be suspected as being malicious and always validated prior to using it as input to the application.
Some examples of input methods:
- Forms Data
- URL parameters
- Hidden Fields
- Cookies
- HTTP Headers or anything in the HTTP request
- Client data entry fields
Items to validate:
- Out of range values/Boundary
- Data length
- Validate types of characters allowed
- Whitelist validation for known good data input while denying all other input.
Other recommendations include:
- Using drop down menus for lists
- Validating input on the server, not on the client.
If validating on the client, also validate on the server:
- Using regular expressions to validate input
- Using HTML filter libraries that implement input validation tasks.
Data received from the user should always be suspected as being malicious and always validated prior to using it as input to the application.
Some examples of input methods:
- Forms Data
- URL parameters
- Hidden Fields
- Cookies
- HTTP Headers or anything in the HTTP request
- Client data entry fields
Items to validate:
- Out of range values/Boundary
- Data length
- Validate types of characters allowed
- Whitelist validation for known good data input while denying all other input.
Other recommendations include:
- Using drop down menus for lists
- Validating input on the server, not on the client.
If validating on the client, also validate on the server:
- Using regular expressions to validate input
- Using HTML filter libraries that implement input validation tasks.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.