CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework
ASP.NET Misconfiguration: Not Using Input Validation Framework
Weakness ID: 554 (Weakness Variant)
Status: Draft
Description
Description Summary
The ASP.NET application does not use an input validation
framework.
Extended Description
Unchecked input is the leading cause of vulnerabilities in ASP.NET
applications. Unchecked input leads to cross-site scripting, process
control, and SQL injection vulnerabilities, among others.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
.NET
Potential Mitigations
Phase
Description
Use the ASP.NET validation framework to check all program input before
it is processed by the application. Example uses of the validation
framework include checking to ensure that: - Phone number fields contain
only valid characters in phone numbers - Boolean values are only "T" or
"F" - Free-form strings are of a reasonable length and composition
Description
