User Input In Sheep’s Clothing
Posted by: youve been HAACKED,
on 09 Jul 2008 |
View original | Bookmarked: 0 time(s)
We all know that it is bad bad bad to trust user input. I dont care if your users are all ascetic monks in a remote monastery, do not trust their input. However, user input often likes to put on sheeps clothing and disguise itself as something else entirely, such as the case with ViewState. Another example of this is highlighted in the latest entry of his excellent series of ASP.NET MVC tips. In this post, Stephen Walther writes about how cookie values and server variables can be passed as parameters...