mirror of
https://github.com/tmoron/darkly.git
synced 2025-09-27 20:58:35 +02:00
error in input_validation readme
This commit is contained in:
@ -7,13 +7,13 @@ Yes we can, and we get a flag.
|
|||||||
|
|
||||||
## Utility of It
|
## Utility of It
|
||||||
This allows an attacker to:
|
This allows an attacker to:
|
||||||
- Submit invalid or malicious data (e.g., score > 10).
|
- Submit invalid or malicious data (e.g., score > 10).
|
||||||
- Manipulate application logic (e.g., gain unfair advantage or retrieve flags).
|
- Manipulate application logic (e.g., gain unfair advantage or retrieve flags).
|
||||||
- Potentially exploit further vulnerabilities if the data is used insecurely elsewhere (e.g., SQL injection, XSS).
|
- Potentially exploit further vulnerabilities if the data is used insecurely elsewhere (e.g., SQL injection, XSS).
|
||||||
|
|
||||||
|
|
||||||
## How Can We Patch It
|
## How Can We Patch It
|
||||||
- Validate all input on the server side regardless of client-side checks.
|
- Validate all input on the server side regardless of client-side checks.
|
||||||
- Enforce boundaries (e.g., score must be between 0 and 10) on the backend.
|
- Enforce boundaries (e.g., score must be between 0 and 10) on the backend.
|
||||||
- Use a schema validation library or built-in mechanisms to reject bad data.
|
- Use a schema validation library or built-in mechanisms to reject bad data.
|
||||||
- Never trust client-side data blindly — browsers can be manipulated.
|
- Never trust client-side data blindly — browsers can be manipulated.
|
||||||
|
Reference in New Issue
Block a user