Should you do validation checks that go outside the possiblility of normal user activity?

Question

Hey guys I have been thinking about form security a lot lately. I have been told time and time again to check if form input is a number if you are expecting a number or escape it in case (unless you use proper mysqli formatting) to avoid injection.

1.After the safety checks are done, should I do additional logic checks? For example, if the user is sending a friend request to them-self for example even if my user interface will not show the form if the user is looking at their own page.

Answer 1

Anything you do in HTML or JavaScript is not sufficient to prevent someone from posting data directly to your HTTP server. So treat anything that is sent by the browser (even cookies!) as "user input" and guard accordingly.

Because even though your form may not allow me to send a friend request to myself, if I'm running Fiddler I can just set a breakpoint, change a POST variable, then resume the request and your server has no idea.

In fact, that's a great eye opening exercise. If you go download Fiddler you can watch everything that the browser sends or receives with your web site. Anything being sent by the browser should not be implicitly trusted.

Answer 2

Yes you should. Haven't we noticed a pattern in some site's URL's and then copied the url but changed some part to get around some restriction in the site bypassing login/access control? Do you want your site to be susceptible to that too?

Answer 3

Of course. The whole point of validation is to properly handle input outside what you're expecting. If users gave you what you expected, you wouldn't have to validate. You need to assume your user could throw absolutely anything at you. As noted, they can bypass the browser entirely using manual HTTP requests. Always code defensively.

Answer 4

Of course.

You can't go far enough validating input. Treat it as garbage and plan accordingly. If you want everything to work smoothly make sure that everything checks out.

Answer 5

A good description I once heard from some famous CS guy (not sure whom, a C writer?) went like "Some time in the early 90's evil on the internet started outgrowing the good on the internet. Any scheme founded upon the idea of enumerating badness is destined to fail (because there's so much of it)".

Don't describe the bad things IE functions like - isSQLcommand(), isJavaScript(), compilesToBinaryandRuns(). This is called Blacklisting and you will exhaust yourself doing it and there is always someone smarter and more evil than you out there.

Instead focus on whitelisting. Enumerate the good, and list only the things you expect to occur. Have a select HTML element with male/female options?

if (selectInput == 'male' || selectInput == 'female'){
    //proceed
}
else {
    //dump the user data and start over
}

EDIT

It was Marcus Ranum, a security expert:

http://www.ranum.com/security/computer_security/editorials/dumb/