AppSecEU08 Input validation: the Good, the Bad and the Ugly

The OWASP 2004 Top Ten adviced to never trust user input. The advice is sound, but led many web application developer to write code that is a maintenance nightmare and insecure. This talk argues that the enthusiasm for input validation must be tempered by a resolve to eliminate code duplication to maintain sanity and security. I will show that it is possible to do so, even in the face of apparently conflicting objectives: usability and protection against malicious users.

The talk's discussion takes place against the backdrop of a case study of a well-intentioned but flawed attempt at implementing meticulous input validation and goes on to suggest some architectural refactoring, often mundane but often neglected, to get rid of the worst code smells. For those who favor life on the bleeding edge, the discussion also ambles into some more tentative territory.