[Esapi-user] [Esapi-dev] Canonicalization and ESAPI's Input Validation Layer

Jim Manico jim.manico at owasp.org
Thu Aug 28 09:17:51 UTC 2014


I'm not sure that I follow...

--
Jim Manico
@Manicode
(808) 652-3805

On Aug 27, 2014, at 11:59 PM, Bedirhan Urgun <bedirhanurgun at gmail.com>
wrote:

what if we have a requirement of processing input like %63 that is sixty
three percent of smt.? I'm sure an example can be found for HTML encoding,
too.

cheers,
bedirhan


2014-08-28 2:51 GMT+03:00 Jim Manico <jim.manico at owasp.org>:

>  ESAPI community,
>
> I am very concerned about the design of the ESAPI validation layer and how
> it handles canonicalization for API's like:
>
> *isValidInput
> <https://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/reference/DefaultValidator.html#isValidInput%28java.lang.String,%20java.lang.String,%20java.lang.String,%20int,%20boolean%29>*(java.lang.String context,
> java.lang.String input, java.lang.String type, int maxLength,
> boolean allowNull)
>
> Right now, before validation, ESAPI will try to decode user input to it's
> normalized form and THEN it will try to validate the input.
> http://owasp-esapi-java.googlecode.com/svn/trunk/src/main/java/org/owasp/esapi/reference/validation/StringValidationRule.java
>
> This seems rather dangerous in that encoded attacks will be "fixed" and
> will not alert of potential malicious input. If input is detected to be
> encoded, then I would suggest that we throw an IntrusionDetectionException
> and stop processing. Why do we "clean up" encoded data and then validate in
> these API's?
>
> Aloha,
> Jim
>
> PS: You certainly can disable canonicalization as it stands today via:
>
>   *isValidInput
> <https://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/reference/DefaultValidator.html#isValidInput%28java.lang.String,%20java.lang.String,%20java.lang.String,%20int,%20boolean,%20boolean%29>*(java.lang.String context,
> java.lang.String input, java.lang.String type, int maxLength,
> boolean allowNull, *boolean canonicalize*)
>
>
> _______________________________________________
> Esapi-dev mailing list
> Esapi-dev at lists.owasp.org
> https://lists.owasp.org/mailman/listinfo/esapi-dev
>
>


-- 

bedirhan urgun
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.owasp.org/pipermail/esapi-user/attachments/20140828/2a3a1fbe/attachment.html>


More information about the Esapi-user mailing list