Navigation Menu

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Please improve input validation in Narro #306

Open
GoogleCodeExporter opened this issue Mar 13, 2015 · 2 comments
Open

Please improve input validation in Narro #306

GoogleCodeExporter opened this issue Mar 13, 2015 · 2 comments
Labels
auto-migrated Priority-Low Type-Enhancement

Comments

@GoogleCodeExporter
Copy link
Collaborator 

Issue:
We'd like to bring Narro back online on Mozilla servers; in the security review 
we carried out for this, we found a number of issues which, while now resolved, 
may not have been exploitable had Narro been more strict on validating input.

As it's entirely possible there are more issues, we'd love to see the input 
validation improved.

Remediation:
Please ensure that, where possible, the application checks that the type, the 
size and the format of input is valid.  For more information on this, please 
consult the Mozilla Secure Coding Guidelines: 
https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Input_Validation

Thanks

Original issue reported on code.google.com by goodwins...@gmail.com on 2 May 2012 at 8:49
@GoogleCodeExporter
Copy link
Collaborator Author

Original comment by alex...@gmail.com on 3 May 2012 at 5:10

  • Changed state: Accepted

@GoogleCodeExporter
Copy link
Collaborator Author 

It's not just a matter of restricting input, which I can't always do, it's 
mostly a matter of escaping the input before being executed or displayed.

Because when you translate you should be able to enter whatever character you 
want.

Original comment by alex...@gmail.com on 3 May 2012 at 5:35

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
auto-migrated Priority-Low Type-Enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@GoogleCodeExporter