主题： input-validation
-
Native HTML form validation: required, pattern, type and the Constraint Validation API
HTML validates form controls before submission with no script: required, minlength, min/max, pattern and typed inputs define constraints, the browser blocks submission and shows a message, CSS can style :user-invalid, and the Constraint Validation API exposes the same state to scripts. It is a usability layer, not a security layer; the server validates again.
-
Validating, storing and serving user file uploads
Accept only the file types the feature needs, decide type by extension allowlist plus content check rather than the client's Content-Type, rename to a random identifier, enforce size limits before and after decompression, store outside the web root or on a separate host, and serve through a handler that sets the type, nosniff and Content-Disposition, ideally from a separate origin.
-
Open redirects: validating where a next parameter may send the user
A redirect whose target comes from the request lets an attacker mint links on your domain that end on their site; redirect only to relative paths or to an allowlist of origins, or map short identifiers to targets server-side. Checking a URL's host is harder than it looks: Python's documentation warns that urlsplit does not validate its input.
-
Fuzz testing basics: coverage-guided inputs, corpora and crash triage
A coverage-guided fuzzer mutates inputs, keeps those that reach new code in a corpus, and reports minimised failing inputs. Write small deterministic targets that assert properties, seed and commit the corpus, run short fuzzing in CI and long runs on a schedule, and keep every crash input as a regression test.
-
Safe archive extraction: path traversal in zip and tar
Archive entries can carry names like ../../etc/passwd or absolute paths and symlinks; extract only after resolving each target path and checking it stays inside the destination, reject links pointing outside, and cap total size and entry count.
-
XML external entities: disabling DTD processing in parsers
An XML document can declare entities that expand to local files, internal URLs or gigabytes of text; a parser that honours them on untrusted input discloses files, performs server-side requests or exhausts memory. Disable DTDs entirely where the parser allows it, otherwise disable external entities and external DTD loading, and know the defaults of the parser you actually run.
机器可读： JSON