Protecting Applications
Diperkenalkan| English | Makna |
|---|---|
| secure by design/sɪˈkjʊə baɪ dɪˈzaɪn/ | Aman Sejak Perancangan |
| secure by default/sɪˈkjʊə baɪ dɪˈfɒlt/ | Aman Secara Bawaan |
| input sanitization/ˈɪnpʊt ˌsænɪtaɪˈzeɪʃn/ | Pembersihan Masukan |
| special characters/ˈspeʃl ˈkærɪktəz/ | Karakter khusus |
| control characters/kənˈtrəʊl ˈkærɪktəz/ | Karakter Kontrol |
| parameterised queries/ˌpærəˈmetəraɪzd ˈkwɪərɪz/ | kueri terparameter |
Aman secara desain dan bawaan
- Secure by design builds security into every phase of development, including how untrusted data reaches a database, browser or file system.
- Secure by default enables protective settings from the start. It reduces risk; it does not guarantee that a product has no vulnerabilities.
Keep input as data
- Input sanitization transforms input for a specific purpose; validation checks an allowed type, length, range or format. Neither is a universal attack filter.
- Quotes and semicolons are ordinary printable special characters, not necessarily control characters. A legitimate name such as
O'Neillshould not be damaged just because it contains an apostrophe.
Choose the control for the destination
Separate SQL values from syntax, protect browser output for its context, and restrict resolved file paths; no universal punctuation filter.
"Secure by default" means a product ships with...
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Safe defaults enable protections from the start; they do not guarantee a vulnerability-free system.
A numeric SQL field accepts 0 OR 1=1. Which control keeps that input from becoming query syntax?
Difficulty 1/5 · 100 coins + a small bonus on first completion today
The input needs no quotes or semicolon. Parameter binding keeps it as data; validate the numeric range too. HTML encoding serves a different destination.
Keep values separate from SQL syntax by using ____ queries.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Bind each value separately rather than joining it into SQL text.
Which statements use controls suited to the destination? Choose all that apply.
Difficulty 2/5 · 140 coins + a small bonus on first completion today
The first three controls match their destinations. A quote blacklist can damage legitimate names and does not protect all three contexts.
Match the control to the destination
- For SQL injection, use parameterised queries: fixed SQL structure and separately bound data values. Validation adds a check but does not replace binding.
- For XSS, render plain text with a safe text API or apply output encoding for the actual HTML, attribute or other context. If HTML is allowed, use a suitable HTML sanitizer.
- For directory traversal, resolve the requested path and require it to remain inside the permitted directory. Rejecting quote characters does not establish that boundary.
Satu daftar hitam karakter tunggal tidak dapat melindungi setiap tujuan. Medan usia dapat disalahgunakan dengan 0 OR 1=1, yang tidak memerlukan tanda kutip atau titik koma. Pertahanan yang tepat menjaga input keluar dari sintaks kueri. Validasi juga harus memeriksa apakah usia adalah angka yang valid dalam rentang yang diizinkan.
Secure by design builds security in from the earliest phase of development.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Security is a design principle, not an add-on.
Pencarian siswa harus menerima nama persis O'Neill. Tulis kueri tetap seperti SELECT name FROM pupils WHERE name = ? dan ikat nama yang dimasukkan secara terpisah. Input seperti ' OR '1'='1 kemudian tetap menjadi satu nilai nama alih-alih mengubah kueri. Saat menampilkan nama, sisipkan sebagai teks; jangan merakit HTML yang dapat dieksekusi darinya. Ini mempertahankan input sah sambil melindungi kedua tujuan dengan kontrol masing-masing.
Bangun keamanan ke dalam desain dan aktifkan default yang aman. Validasi input sesuai tugas, pisahkan nilai SQL dari sintaks SQL, kodekan atau tampilkan output browser dengan aman, dan terapkan batas sistem file. Jangan mengklaim bahwa menghapus tanda baca menghentikan semua serangan input.