...
| Code Block |
|---|
<item> <description>Widget</description> <price>500.0</price> <quantity>1</quantity><price>1.0</price><quantity>1</quantity> </item> |
An XML parser may interpret the XML in this example such that the second price field overrides the first, changing the price of the item to $1. Alternatively, the attacker may be able to inject special characters, such as comment blocks and CDATA delimiters, which corrupt the meaning of the XML.
Noncompliant Code Example
...
Related Guidelines
| CERT Perl Secure Coding Standard | IDS33-PL. Sanitize untrusted data passed across a trust boundary |
Injection [RST] | |
CWE-116, Improper encoding or escaping of output |
...
A Guide to Building Secure Web Applications and Web Services | |
[W3C 2008] | 4.4.3, "Included If Validating" |
...
Rule 00: Input Validation and Data Sanitization (IDS) Rule 00: Input Validation and Data Sanitization (IDS)