Malicious input can often catch us by surprise. We tend to cater to the common cases, but we can easily neglect more esoteric vulnerabilities resulting from unexpected or forgotten behaviors.
In the main recipe, we'll focus on the parameter pollution case, in the There's More section we'll cover other important, but often unfamiliar areas such as JSON validation and user input driven Buffer creation.
Parameter pollution is quite a subtle form of attack, and if we're not aware of the default way our framework and code handles this form of input validation, we may open ourselves to Denial of Service attacks, and in some cases allow for XSS or CSRF attacks.
In this recipe, we're going to protect a server from HTTP Parameter pollution.
