Timothy Goddard
10/7/2006 12:54:00 PM
David Vallner wrote:
> Ben V. wrote:
> > In my application, I cannot allow the user to enter the "\" character in
> > their URL.
>
> Might be Windows muscle memory. Consider silently replacing it with a
> forward slash instead of reporting an error to the user?
When your skin gets exposed to UV light the cells are damaged by the
high energy rays. When the damage exceeds a certain level, the cell has
more potential to damage the organism than help it. The cell responds
to this by committing a form of cellular suicide, called apoptosis.
Applying the same principle to code can produce much more robust
applications than you otherwise would get. If a connection acts
unusually suspiciously, it's often much better to forcefully fail than
to attempt to fix the problem. This is mainly because an attempt to fix
the problem may in itself fail, the validation code becomes much
bulkier and as a result more error prone, and you stand less chance of
giving away information to an attacker.
Whenever suspicious activity is detected (within reason) a generic
failure is usually the best course of action. Mongrel is a very good
example of a Ruby project which takes this approach and is considered
highly secure as a result (I have no connection to the Mongrel
project). If an incorrect HTTP request is encountered it simply drops
the connection, preventing any information from being given to what may
well be an attacker.
> David Vallner
>
>
> --------------enig37D1C7888B1F3957ECD1E646
> Content-Type: application/pgp-signature
> Content-Disposition: inline;
> filename="signature.asc"
> Content-Description: OpenPGP digital signature
> X-Google-AttachSize: 188