主题： input-validation

• HTML 原生表单验证：required、pattern、type 与 Constraint Validation API

  HTML 无需脚本即可在提交前验证表单控件：required、minlength、min/max、pattern 和指定类型的输入定义约束，浏览器阻止提交并显示消息，CSS 可为 :user-invalid 设置样式，Constraint Validation API 则向脚本暴露同一状态。这是易用性层，而非安全层；服务器仍会再次验证。

  article · zh · reviewed · 知识截至 2026-09-16

• Testing that profile updates cannot assign privileged account fields

  Create a narrow regression for updates that accept ordinary profile data alongside fields the caller must not control. The method proposes explicit field ownership rather than a generic input-validation checklist.

  methodology · en · reviewed · 知识截至 2026-09-22

• Validating, storing and serving user file uploads

  Accept only the file types the feature needs, decide type by extension allowlist plus content check rather than the client's Content-Type, rename to a random identifier, enforce size limits before and after decompression, store outside the web root or on a separate host, and serve through a handler that sets the type, nosniff and Content-Disposition, ideally from a separate origin.

  methodology · en · reviewed · 知识截至 2026-09-16

• 开放重定向：验证 next 参数可以将用户送往何处

  如果重定向目标来自请求，攻击者就能创建位于你的域名、最终却进入其网站的链接。应仅重定向到相对路径或允许列表中的源，或在服务器端将短标识符映射为目标。检查 URL 主机比看起来更难：Python 文档提醒，urlsplit 不会验证输入。

  article · zh · reviewed · 知识截至 2026-09-15

• 模糊测试基础：覆盖率引导的输入、语料库与崩溃分析

  覆盖率引导的模糊测试器会变异输入，将触达新代码的输入保留在语料库中，并报告最小化后的失败输入。应编写小型、确定性的目标函数并断言属性，用种子初始化语料库并提交，CI 中短时运行、按计划长时运行，将每个崩溃输入保留为回归测试。

  article · zh · reviewed · 知识截至 2026-09-15

• 安全解压归档：zip 和 tar 中的路径遍历

  归档条目可能使用 ../../etc/passwd 这样的名称、绝对路径或符号链接。只有解析每个目标路径并确认它仍位于目标目录内后，才可解压；拒绝指向目录外的链接，并限制总大小和条目数量。

  article · zh · reviewed · 知识截至 2026-09-15

• XML external entities: disabling DTD processing in parsers

  An XML document can declare entities that expand to local files, internal URLs or gigabytes of text; a parser that honours them on untrusted input discloses files, performs server-side requests or exhausts memory. Disable DTDs entirely where the parser allows it, otherwise disable external entities and external DTD loading, and know the defaults of the parser you actually run.

  article · en · reviewed · 知识截至 2026-09-16

机器可读： JSON