| 名称 |
Resource Injection |
|
|
| 摘要 |
An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource. |
| 前置条件 |
The target application allows the user to both specify the identifier used to access a system resource. Through this permission, the user gains the capability to perform actions on that resource (e.g., overwrite the file) |
| 解决方案 | Ensure all input content that is delivered to client is sanitized against an acceptable content specification. Perform input validation for all content. Enforce regular patching of software. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-99 |
Improper Control of Resource Identifiers ('Resource Injection') |
|
| 分类体系：OWASP Attacks |
|
条目编号
|
条目名称
|
| Link |
Resource Injection |
|