2131
Scope Impact Likelihood
Since quantities are used so often to affect resource
allocation or process financial data, they are often present
in many places in the code.
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
input validation, consider all potentially relevant properties, including length, type of input, the
full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if the input
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright.
Effectiveness = High
Demonstrative Examples
Example 1:
This example demonstrates a shopping interaction in which the user is free to specify the quantity
of items to be purchased and a total is calculated.
Example Language: Java (Bad)
...
public static final double price = 20.00;
int quantity = currentUser.getAttribute("quantity");
double total = price * quantity;
chargeUser(total);
...
The user has no control over the price variable, however the code does not prevent a negative
value from being specified for quantity. If an attacker were to provide a negative value, then the
user would have their account credited instead of debited.
Example 2:
This example asks the user for a height and width of an m X n game board with a maximum
dimension of 100 squares.
Example Language: C (Bad)
...
#define MAX_DIM 100
...
/* board dimensions */
int m,n, error;
board_square_t *board;
printf("Please specify the board height: \n");
error = scanf("%d", &m);
if ( EOF == error ){
die("No integer passed: Die evil hacker!\n");
}
printf("Please specify the board width: \n");
error = scanf("%d", &n);
CWE Version 4.14
CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input