Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Documents
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
Application Security and Development Security Technical Implementation Guide
SRG-APP-000447
The application must not be subject to input handling vulnerabilities.
The application must not be subject to input handling vulnerabilities.
An XCCDF Rule
Details
Profiles
Prose
The application must not be subject to input handling vulnerabilities.
High Severity
<VulnDiscussion>A common application vulnerability is unpredictable behavior due to improper input validation. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information system responses to the invalid input may be disruptive or cause the system to fail into an unsafe state. Data received from the user should always be suspected as being malicious and always validated prior to using it as input to the application. Some examples of input methods: - Forms Data - URL parameters - Hidden Fields - Cookies - HTTP Headers or anything in the HTTP request - Client data entry fields Items to validate: - Out of range values/Boundary - Data length - Validate types of characters allowed - Whitelist validation for known good data input while denying all other input. Other recommendations include: - Using drop down menus for lists - Validating input on the server, not on the client. If validating on the client, also validate on the server: - Using regular expressions to validate input - Using HTML filter libraries that implement input validation tasks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>