platformQuickStarts
webgoat-container
webgoat-images
webgoat-lessons
bypass-restrictions
challenge
client-side-filtering
command-injection
cross-site-scripting
csrf
html-tampering
src
main
java
resources
html
i18n
images
lessonPlans
en
HtmlTampering_Intro.adoc
HtmlTampering_Mitigation.adoc
HtmlTampering_Task.adoc
pom.xml
http-basics
http-proxies
idor
insecure-login
jwt
sql-injection
vulnerable-components
webgoat-lesson-template
xxe
pom.xml
sol.txt
webgoat-server
.gitignore
.travis.yml
README.MD
buildspec.yml
mvn-debug
pom.xml
webgoat_developer_bootstrap.sh
15 lines
601 B
Plaintext
Executable File
15 lines
601 B
Plaintext
Executable File
=== Mitigation
|
|
|
|
In this simple example you noticed that the price is calculated server side and send to the server. The server
|
|
accepted the input as a given and did not calculate the price again. One of the mitigations in this case is to look up
|
|
the price of the television in your database and calculate the total price again.
|
|
|
|
|
|
In a real application you should never rely on client side validation it is important to verify all the input
|
|
send by the client. Always remember: **NEVER TRUST INPUT SEND BY A CLIENT.**
|
|
|
|
''''
|
|
==== References
|
|
|
|
https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet
|