Data Validation (DVL) Class

Definition

We define Data Validation Bugs (DVL) as follows:

Data are validated (syntax check) or sanitized (escape, filter, repair) improperly.

Taxonomy

Fig. 1 depicts DVL causes, attributes and consequences.

Operations

The DVL operations are: Validate and Sanitize. They reflect the improper check and modification of data syntax.

Operation Value	Definition
Validate	Check data syntax (proper form/grammar) in order to accept (and possibly sanitize) or reject it. Includes checking for missing symbols/elements.
Sanitize	Modify data (neutralize/escape, filter/remove, repair/add symbols) in order to make it valid (well-formed).

Causes

The graph of causes shows that there are three main causes for data validation bugs: Improper Operation, Improper Data, and Improper Policy.

Improper Operation
Value	Definition	Example
Missing	The operation is absent.	Missing data sanitization.
Erroneous	There is a bug in the implementation of the operation (incl. how it checks against a policy).	Using not equal to (!=) when comparing to safelist values. Using greater than (>) when checking for upper range.
Under-Restrictive Policy	Accepts bad data.	Permissive safelist or regular expression. Incomplete denylist.
Over-Restrictive Policy	Rejects good data.	Over-restrictive denylist or regular expression.

Improper Data
Value	Definition
Corrupted Data	Unintentionally modified data due to a previous weakness (e.g., with a decompress or a decrypt operation) that if not sanitized would end-up as invalid data for next weakness.
Tampered Data	Maliciously modified data due to a previous weakness (e.g., with a deserialize, authorize, or crypto verify operation) that would lead to injection error.

Improper Policy
Value	Definition
Corrupted Policy	Unintentionally modified policy due to a previous weakness (e.g., with a decompress operation).
Tampered Policy	Maliciously modified policy due to a previous weakness (e.g., with an authorize operation).

Consequences

The graph of consequences shows Improper Data for Next Operation and Injection Error as consequences.

Improper Data for Next Operation
Value	Definition
Invalid Data	Data with harmed syntax due to sanitization errors.

Injection Error
Value	Definition	Example
Query Injection	Malicious insertion of condition parts (e.g., or 1==1) or entire commands (e.g., drop table) into an input used to construct a database query.	SQL Injection No SQL Injection XPath Injection XQuery Injection LDAP Injection
Command Injection	Malicious insertion of new commands into the input to a command that is sent to an operating system (OS) or to a server.	OS Command Injection Regular Expression Injection IMAP/SMTP Command Injection Object Injection (JSON server side)
Source Code Injection	Malicious insertion of new code (incl. with <> elements) into input used as part of an executing application code.	Cross Site Scripting (XSS) CSS Injection Eval Injection EL Injection JSON Injection (Client or Server Side)
Parameter Injection	Malicious insertion of data (e.g., with & parameter separator) into input used as parameter/argument in other parts of code.	Argument Injection Format String Injection Email Injection HTTP Header Injection (incl. Server Header Injection) Reflection Injection Flash Injection CRLF Injection (incl. HTTP Header Splitting)
File Injection	Malicious insertion of data (e.g., with .. and / or with file entries) into input used to access/modify files or as file content.	CSV, Temp, etc. File Injection Log Entry Injection XML Injection CRLF Injection (incl. in as in log entry files) Relative Path Traversal Absolute Path Traversal

Attributes

The attributes of DVL are:

Name	Value	Definition
Mechanism	Safelist	Policy based on a set of known good content.
	Denylist	Policy based on a set of known bad content; helps reject outright maliciously malformed data.
	Format	Policy based on syntax format (e.g., defined via regular expression).
	Length	Policy based on allowed number of characters in data. Note that this is not about the data value as size of an object.
Source Code	Codebase	The operation is in programmer’s code – in the application itself.
	Third Party	The operation is in a third party library.
	Standard Library	The operation is in the standard library for a particular programming language.
	Language Processor	The operation is in the tool that allows execution or creates executable (compiler, assembler, interpreter).
Execution Space	Local	The bugged code runs in an environment with access control policy with limited (local user) permission.
	Admin	The bugged code runs in an environment with access control policy with unlimited (admin user) permission.
	Bare-Metal	The bugged code runs in an environment with-out privilege control. Usually, the program is the only software running and has total access to the hardware.
State	Entered	Data comes from user interface (e.g., text field).
	Stored	Data comes from permanent storage (e.g., file, database on a storage device).
	In Use	Data comes from volatile storage (e.g., RAM, cache memory).
	Transferred	Data comes via network (e.g., connecting analog device or another computer).

Sites

A site for input/output check bugs is any part of the code that should check and sanitize data syntax or check and correct data semantics.

Application

Application examples are provided here.