Problem - Kevin Tafuro

try to use them. For example, what happens if the attacker puts a single quote in
the data? Will that end the quoting, allowing the rest of the attacker’s data to do
malicious things? If there are such escapes, you should check for them. In this
particular example, you might be able to replace quotes in the attacker’s data
with a backslash followed by a quote.
When designing your own quoting mechanisms, do not allow escapes.
Following from the previous point, if you need to filter data instead of rejecting
potentially harmful data, it is useful to provide functions that properly quote an
arbitrary piece of data for you. For example, you might have a function that
quotes a string for a database, ensuring that the input will always be interpreted
as a single string and nothing more. Such a function would put quotes around
the string and additionally escape anything that could thwart the surrounding
quotes (such as a nested quote).
The better you understand the data, the better you can filter it.
Rough heuristics like “accept the following characters” do not always work well
for data validation. Even if you filter out all bad characters, are the resulting
combinations of benign characters a problem? For example, if you pass
untrusted data through a shell, do you want to take the risk that an attacker
might be able to ignore metacharacters but still do some damage by throwing in
a well-placed shell keyword?
The best way to ensure that data is not bad is to do your very best to understand
the data and the context in which that data will be used. Therefore, even if
you’re passing data on to some other component, if you need to trust the data
before you send it, you should parse it as accurately as possible. Moreover, in situations
where you cannot be accurate, at least be conservative, and assume that
the data is malicious.
See Also
Recipes 1.7, 3.3, 3.9, 3.11
3.2 Preventing Attacks on Formatting Functions
Problem
You use functions such as printf( ) or syslog( ) in your program, and you want to
ensure that you use them in such a way that an attacker cannot coerce them into
behaving in ways that you do not intend.
Preventing Attacks on Formatting Functions | 75
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.