Input Validation Tapestries

An awareness design to tell your peer developers to implement input validation to prevent injection, buffer overflows, denial of service or even log sanitisation.

Insecure deserialisation could lead to remote code execution if no proper validation is done previously.

A design about the the common weakness enumeration 20 also known as improper input validation. If user input is not properly escaped, sanitised and validated then the attackers can perform DoS, RCE or even tamper the information.

A funny design of a samoyed reminding the importance of doing input validation before processing any user provided data.

A cool and funny way to remind one of the OWASP guidelines, the A3:2021. This design will guide your developers to follow the best practices to avoid Injections on code no matter it is LDAP, XML, SQL, Command and so on.

Here's a cheat sheet like design to remind some of the secure coding measures to prevent all kind XSS attacks: Reflective, Stored or DOM based. Failing to do so, will imply code execution on victim's browser when visiting your site.

Any input that is controllable by the user is susceptible of being manipulated and turn it as an evil payload for remote code execution on the victim server.

Developers are under great pressure with aggressive delivering dates but, one of the most important things that they shouldn't overlook, is to applying input validation in the functions or methods.

Fuzzing is an important testing to be done on running applications because it can catch flaws that static analysis can't like buffer overflows or memory corruption. This is a black background with white letters design version.

A design version with white letters and black background, This is a reminder for developers to replace any print used for debugging purposes with logger to write them in files.

To protect from file upload attacks on your website that could leave attackers to upload malicious software or backdoors, here's some of the protections to prevent such attacks.

When dealing with multithreading applications, it is important to make a copy of the input mutable object before processing it to avoid race conditions.

One of the recommendations of secure coding is to practice pair programming, because 4 eyes catches more than 2 and it is a good way to share context and knowledge between coworkers.

If the web application is not properly implemented and it doesn't performs input validation correctly on login, then it could be bypassed by sql injection.

This should be the input validation steps that the code must do to avoid processing harmful untrusted data.

This is a cool and funny design to certify that the code is free of any possible injection threats following the best practices like OWASP or CWE.

APP Security Engineer is a Cool design of this role tittle. If you are this kind of cybersecurity professional, your duty is to reduce the risk as much as possible in code and dependencies. Also you'll enact activities like threat modelling, malware scanning, secure coding practices and correct secret management. This is a design version with black background.

Threat modeling should be a mainstream activity for every current and new designs to better understand which could be the threats and which could be the security measures to mitigate the risk.

A shield design of the input validation steps that developers should do in the methods or functions that manipulates untrusted data. This is one of the best practice of OWASP for secure coding.

Awareness design to remind the importance of validating zip files before decompressing it like limiting the number of files, the decompressed size and a maximum decompressed file size.

Besides input validation which avoids processing any untrusted data by the application, it is important to perform output validation when writing logs, not only to avoid disclosing any sensitive information but also to prevent local file inclusion attacks.

This should be the input validation steps that the code must do to avoid processing harmful untrusted data.