CWE-184 不完整的黑名单

Incomplete Blacklist

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

An application uses a "blacklist" of prohibited values, but the blacklist is incomplete.

扩展描述

If an incomplete blacklist is used as a security mechanism, then the software may allow unintended values to pass into the application logic.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 693 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 1023 cwe_View_ID: 1000

• cwe_Nature: CanPrecede cwe_CWE_ID: 79 cwe_View_ID: 1000 cwe_Chain_ID: 692

• cwe_Nature: CanPrecede cwe_CWE_ID: 78 cwe_View_ID: 1000

• cwe_Nature: CanPrecede cwe_CWE_ID: 434 cwe_View_ID: 1000

• cwe_Nature: CanPrecede cwe_CWE_ID: 98 cwe_View_ID: 1000

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

检测方法

Black Box

可能的缓解方案

Implementation

策略: Input Validation

Combine use of blacklist with appropriate use of whitelists.

Implementation

策略: Input Validation

Do not rely exclusively on blacklist validation to detect malicious input or to encode output. There are too many variants to encode a character; you're likely to miss some variants.

示例代码

例

The following code attempts to stop XSS attacks by removing all occurences of "script" in an input string.

bad Java

Because the code only checks for the lower-case "script" string, it can be easily defeated with upper-case script tags.

分析过的案例