OWASP Top Ten Proactive Controls 2018 | C4: Encode and Escape Data | OWASP Foundation

Overview

This webpage provides information on the OWASP Top Ten Proactive Controls for 2018, specifically focusing on C4: Encode and Escape Data. It explains the importance of encoding and escaping as defensive techniques to prevent injection attacks. The webpage also discusses the different types of encoding and provides examples for Java, .NET, and PHP. It highlights the significance of contextual output encoding to mitigate XSS attacks. Additionally, it mentions other types of encoding and injection defense, such as OS command escaping and XML attribute escaping. The webpage emphasizes the role of character encoding and canonicalization in securing against attacks. It concludes by listing the vulnerabilities prevented by implementing the C4 control and providing references and tools for further information.

Description

This webpage provides information on OWASP Top Ten Proactive Controls 2018, specifically focusing on C4: Encode and Escape Data. It explains the significance of encoding and escaping as defensive techniques to prevent injection attacks. The webpage covers contextual output encoding, providing examples for Java, .NET, and PHP. It also mentions other types of encoding and injection defense techniques. The role of character encoding and canonicalization in securing against attacks is highlighted. The webpage concludes by listing the vulnerabilities prevented by implementing the C4 control and providing references and tools for further information.

How to Prevent ?

To prevent injection attacks, it is crucial to implement encoding and escaping techniques. Output encoding should be applied just before passing content to the target interpreter. Contextual output encoding plays a critical role in stopping XSS attacks and depends on the location or context in the document. Different types of encoding, including HTML Entity Encoding, HTML Attribute Encoding, JavaScript Encoding, and URL Encoding, should be used for building secure user interfaces. Encoding examples for Java, .NET, and PHP are provided. Additionally, other forms of encoding and injection defense, such as OS command escaping, XML attribute escaping, and LDAP distinguished name escaping, can be employed to neutralize content against different forms of injection. It is essential to ensure secure character encoding and canonicalization to protect against attacks related to malformed Unicode and other character representations.

Example Attack Scenarios:

• OWASP Top 10 2017 - A1: Injection:  The C4 control helps prevent injection attacks, which are ranked as the top vulnerability in OWASP Top 10 2017. By implementing encoding and escaping techniques, the risk of injection vulnerabilities can be mitigated.

• OWASP Top 10 2017 - A7: Cross Site Scripting (XSS):  Contextual output encoding, a key component of the C4 control, is essential for preventing cross-site scripting (XSS) attacks. By properly encoding untrusted data before adding it to HTML, the risk of XSS vulnerabilities is minimized.

• OWASP Mobile_Top_10_2014-M7 Client Side Injection:  The C4 control also helps prevent client-side injection vulnerabilities, specifically mentioned in the OWASP Mobile Top 10 2014. By implementing encoding and escaping techniques, the risk of client-side injection vulnerabilities can be reduced.