Things to Check on the Web

– Check field names so that only expected ones are handled.
If another variable is submitted, ignore it or return an error.
– Always check data in hidden fields.
It is desirable to use an MD5 hash or similar.
– Always check the length of variables.
Do not rely on the length specified in a form; check lengths and return an error or truncate values longer than expected.
– Do not trust the Referer.
It can easily be forged.
– When using cookies, check their reliability.
• Is the cookie format correct?
• Was this cookie sent from the correct IP address?
• When using cookies, SSL is desirable because it makes things easier.
– Open files explicitly in read mode.
– Scrutinize characters contained in file names.
• Such as | or ..
– Check characters in input. In particular, check whether a NULL character (%00) is present.
– Do not trust preprocessing by JavaScript.
– Take great care when using GET/POST/COOKIE variables as arguments to system calls or pipes. Basically, before using such variables for anything, check that they are expected values.
– In Perl, use system() as a list.
e.g. system \’wc\’, \’-c\’, $file;
– In Perl, use fork() + exec() rather than backticks.