The application must not be subject to input handling vulnerabilities.

Description

<VulnDiscussion>A common application vulnerability is unpredictable behavior due to improper input validation. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information system responses to the invalid input may be disruptive or cause the system to fail into an unsafe state. Data received from the user should always be suspected as being malicious and always validated prior to using it as input to the application. Some examples of input methods: - Forms Data - URL parameters - Hidden Fields - Cookies - HTTP Headers or anything in the HTTP request - Client data entry fields Items to validate: - Out of range values/Boundary - Data length - Validate types of characters allowed - Whitelist validation for known good data input while denying all other input. Other recommendations include: - Using drop down menus for lists - Validating input on the server, not on the client. If validating on the client, also validate on the server: - Using regular expressions to validate input - Using HTML filter libraries that implement input validation tasks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>