Difference between revisions of "Implement interface contracts"

From OWASP
Jump to: navigation, search
(Reverting to last version not containing links to s1.shard.jp)
 
(4 intermediate revisions by 2 users not shown)
Line 1: Line 1:
[http://s1.shard.jp/olharder/auto-reply-business.html 4 auto golf toscana usate
 
] [http://s1.shard.jp/losaul/yamaha-outboard.html price is right tickets australia
 
] [http://s1.shard.jp/galeach/new134.html tasiaspaidlinks.com
 
] [http://s1.shard.jp/galeach/new151.html posisi rahasia
 
] [http://s1.shard.jp/olharder/cheat-sheets.html sports autograph shows
 
] [http://s1.shard.jp/frhorton/ufkvsduv1.html african poetry theatre] [http://s1.shard.jp/olharder/autoroll-654.html http] [http://s1.shard.jp/olharder/sood-automobiles.html auto importazione
 
] [http://s1.shard.jp/olharder/auto-classifieds.html automatic coffee maker plumbed
 
] [http://s1.shard.jp/olharder/autorizadas.html auto fuel oil used vegetable
 
] [http://s1.shard.jp/galeach/new42.html ancient asian religions] [http://s1.shard.jp/bireba/avg-antivirus.html antivirus software information
 
] [http://s1.shard.jp/frhorton/vuku1m6uz.html african american life during the great deppression
 
] [http://s1.shard.jp/frhorton/mxbohv5lf.html african lion physiology
 
] [http://s1.shard.jp/bireba/g-data-antivirus.html antivirus realtime protection failed to load
 
] [http://s1.shard.jp/frhorton/9viywdetn.html deadly virus 1976 african river
 
] [http://s1.shard.jp/bireba/nortons-antivirus.html nortons antivirus 2005 activation crack] [http://s1.shard.jp/frhorton/bnd824p72.html making african mask
 
] [http://s1.shard.jp/bireba/antivirus-avg7.html avg antivirus 7.302 crack
 
] [http://s1.shard.jp/frhorton/l2ids56ra.html vodashop south africa
 
] [http://s1.shard.jp/bireba/grisoft-antivirus.html grisoft antivirus free download] [http://s1.shard.jp/frhorton/c769e8i7o.html african american barrier hypertension in male treatment
 
] [http://s1.shard.jp/bireba/norton-antivirus.html antivirus linux freeware
 
] [http://s1.shard.jp/frhorton/dfj31yuuh.html budget renta car south africa
 
] [http://s1.shard.jp/bireba/symantec-antivirus.html mcafee free antivirus downloads
 
] [http://s1.shard.jp/frhorton/fhh2j9s8e.html african-american - latino - childrens books
 
] [http://s1.shard.jp/frhorton/2wh6r9nyq.html africa development ford foundation
 
] [http://s1.shard.jp/frhorton/zedmbj3he.html movie nowhere in africa
 
] [http://s1.shard.jp/olharder/autoroll-654.html webmap] [http://s1.shard.jp/olharder/automotive-training.html autocad fonts downloads
 
] [http://s1.shard.jp/frhorton/l648khtsn.html 1900 african american before brazos county in name school
 
] [http://s1.shard.jp/frhorton/cluquehu7.html africa south of the sahara europa
 
] [http://s1.shard.jp/bireba/mcaffe-antivirus.html 2006 winantivirus
 
] [http://s1.shard.jp/frhorton/1tzcpt1xe.html roedean south africa] [http://s1.shard.jp/galeach/new5.html asian teen boys
 
] [http://s1.shard.jp/galeach/new59.html asia bag gift] [http://s1.shard.jp/galeach/new166.html 015100482x amazon.com asian exec obidos
 
] [http://s1.shard.jp/frhorton/nypq37a4u.html slavery south africa
 
] [http://s1.shard.jp/losaul/civil-aviation-safety.html civil aviation safety authority of australia] [http://s1.shard.jp/bireba/avast-free-antivirus.html avast free antivirus software] [http://s1.shard.jp/frhorton/9df15nbui.html alamo car hire south africa
 
] [http://s1.shard.jp/frhorton/qtlusvqfk.html west african countries] [http://s1.shard.jp/galeach/new152.html asian b b b b bi...movies.wmv girl
 
] [http://s1.shard.jp/bireba/antivirus-small.html comparaison antivirus
 
] [http://s1.shard.jp/galeach/new13.html mall of asia philippines
 
] [http://s1.shard.jp/olharder/autoroll-654.html links] [http://s1.shard.jp/losaul/real-estate-western.html cheap domestic flights in australia
 
] [http://s1.shard.jp/bireba/avg-antivirus-73.html avg antivirus 6.0
 
] [http://s1.shard.jp/frhorton/map.html african american soldiers civil war
 
] [http://s1.shard.jp/bireba/norton-antivirus.html norton antivirus 2005 keys] 
 
[http://s1.shard.jp/losaul/australia-jeri.html 3 australian formula
 
] [http://s1.shard.jp/olharder/kragen-auto.html auto cheat city grand thief vice
 
] [http://s1.shard.jp/bireba/notron-antivirus.html notron antivirus] [http://s1.shard.jp/olharder/autoroll-654.html webmap] [http://s1.shard.jp/olharder/route-66-auto.html automobile vinyl top installation
 
] [http://s1.shard.jp/losaul/nlp-training.html australian standard classification of occupation
 
] [http://s1.shard.jp/galeach/new103.html asia pacific region facts
 
] [http://s1.shard.jp/bireba/symantec-antivirus.html symantec antivirus corporate edition v 10.0] [http://s1.shard.jp/bireba/www-avg-antivirus.html disable norton antivirus 2004
 
] [http://s1.shard.jp/olharder/napa-auto-parts.html dirt cheap auto insurance michigan
 
] [http://s1.shard.jp/frhorton/tyyykyebz.html aids in kenya africa
 
] [http://s1.shard.jp/frhorton/v8af479gm.html the first african american basketball player
 
] [http://s1.shard.jp/losaul/australian-cricket.html australia pajero
 
] [http://s1.shard.jp/olharder/autoroll-654.html links] [http://s1.shard.jp/losaul/australia-bank-fee.html australian meals made through the gold rush
 
] [http://s1.shard.jp/galeach/new81.html asian grocery denver
 
] [http://s1.shard.jp/frhorton/rlw3nqlyf.html south africa safaries
 
] [http://s1.shard.jp/bireba/norton-antivirus.html antivirus filtering
 
] [http://s1.shard.jp/bireba/innoculate-antivirus.html pop pro up winantivirus
 
] [http://s1.shard.jp/olharder/removing-auto-paint.html automation form greibach normal theory
 
] [http://s1.shard.jp/frhorton/ony5d5273.html african child labor picture images
 
] [http://s1.shard.jp/losaul/liberal-party.html australia land tours
 
] [http://s1.shard.jp/olharder/keystone-automotive.html price on automobile glass
 
] [http://s1.shard.jp/losaul/australian-laws.html home and away australian soap opera
 
] [http://s1.shard.jp/olharder/sunnyside-auto.html auto body shop in minnesota
 
] [http://s1.shard.jp/olharder/auto-automobile.html left eye autopsy photo
 
] [http://s1.shard.jp/galeach/new84.html asian woman fashion magazine
 
] [http://s1.shard.jp/losaul/used-car-price.html ink cartridge australia
 
] [http://s1.shard.jp/olharder/autoroll-654.html index] [http://s1.shard.jp/bireba/extendia-antivirus.html nortan antivirus 2005 serial key
 
] [http://s1.shard.jp/galeach/new18.html asian avenue graphic
 
] [http://s1.shard.jp/losaul/australian-capital.html australian army history grants
 
] [http://s1.shard.jp/galeach/new143.html voluntary euthanasia
 
] [http://s1.shard.jp/bireba/norton-antivirus.html avant antivirus
 
] [http://s1.shard.jp/galeach/new36.html asiatic carpets
 
] [http://s1.shard.jp/frhorton/bzsc3x6qn.html south african safari club
 
] [http://s1.shard.jp/losaul/australia-inc-lottery.html australia inc lottery lotto programme] [http://s1.shard.jp/frhorton/hpi2k8yhb.html african american civil movement right woman
 
] [http://s1.shard.jp/olharder/autoroll-654.html sitemap] [http://s1.shard.jp/bireba/download-norton.html types of antivirus software
 
] [http://s1.shard.jp/olharder/autoroll-654.html webmap] [http://s1.shard.jp/olharder/internet-auto-part.html auction auto public wyoming
 
] [http://s1.shard.jp/olharder/o-riley-autoparts.html automotive carpet custom
 
] [http://s1.shard.jp/olharder/auto-start.html auto+trader
 
] [http://s1.shard.jp/frhorton/zgxfpsa75.html african ibo masks
 
] [http://s1.shard.jp/olharder/autoroll-654.html link] [http://s1.shard.jp/losaul/australia-importing.html australian council midwifery
 
] [http://s1.shard.jp/losaul/australian-import.html australia divorce laws
 
 
 
{{Template:SecureSoftware}}
 
{{Template:SecureSoftware}}
  

Latest revision as of 07:50, 3 June 2009


Overview

Purpose:

  • Provide unit-level semantic input validation.
  • Identify reliability errors in a structured way at the earliest point in time.

Role:

  • Implementer

Frequency:

  • As needed; generally as functions or methods are modified.

Interface contracts are also commonly known as assertions. They can be a formidable tool for preventing security problems - particularly if applied consistently, and rigorously.

In many application development processes, interface contracts are not enabled in production software. They are removed by habit in order to improve efficiency. If the efficiency impact is nominal for the project, CLASP strongly recommends leaving such checks in the code for the sake of security.

Otherwise, checks of security critical parameters should be implemented using a permanent mechanism, such as code directly at the top of the function, as discussed in activities below.

Implement validation and error handling on function or method inputs

For each method or function visible outside its compilation unit, specify in code what the expectations are for valid input values. One should validate that each input variable has a valid value in and of itself, and should determine validity in relation to other inputs. Validation checks should contain no side effects. Failures should be handled as specified in design. See CLASP Resource B for the concept on input validation.

Input variables should not be constrained to parameters. Any variable read by the function or method should be considered an input variable - including global variables, and class and method variables. Note that some interface contract facilities will allow specifying invariants for an entire class - i.e., things that must always be true about class data before and after each method invocation - once.

Implement validation on function or method outputs

Perform the same validation between relationships before exiting a function or method. Output specifications are meant to provide a clear behavioral specification to calling code to prevent accidental misuse.

Generally, output validation code is most useful in implementation. It is reasonable to disable such code for deployment or even use pseudo-code if absolutely necessary.