alle afkortingen zijn nu commando's, clobber toegevoegd naast clean speciaal voor...

[ssproject1617.git] / report / v5_input.tex

diff --git a/report/v5_input.tex b/report/v5_input.tex
index 27ee206..4eb09e4 100644 (file)
--- a/report/v5_input.tex
+++ b/report/v5_input.tex
@@ -45,8 +45,8 @@
                \srcref{classes/users.php}{145}.
                \end{result}
 
-       \item\pass{} Verify that the application is not susceptible to LDAP
-               Injection, or that security controls prevent LDAP Injection.
+       \item\pass{} Verify that the application is not susceptible to \LDAP{}
+               Injection, or that security controls prevent \LDAP{} Injection.
 
                \begin{result}
                \LDAP{} is not used, thus the application is not susceptible.
@@ -72,7 +72,7 @@
                recovery\\
                (\srcref{classes/user.php}{115}) filepaths are calculated on the
                hash of the password. All non standard filepaths, such as admin or
-               theme files, are generated using functions. CMS urls are parsed using a
+               theme files, are generated using functions. \CMS{} urls are parsed using a
                standard system wide \code{parse} function.
                \end{result}
 
@@ -89,10 +89,10 @@
                web client code is either properly contextually encoded manually, or
                utilize templates that automatically encode contextually to ensure the
                application is not susceptible to reflected, stored and DOM Cross-Site
-               Scripting (XSS) attacks.
+               Scripting (\XSS{}) attacks.
 
                \begin{result}
-               A lot of \HTML{} tags are allowed in the post screen, therefore an XSS
+               A lot of \HTML{} tags are allowed in the post screen, therefore an \XSS{}
                attack is trivial. Even the comment section uses no input validation
                whatsoever.
                \end{result}
@@ -104,15 +104,15 @@
                malicious automatic binding.
 
                \begin{result}
-               There is some automatic variable binding happening in the POST and GET
+               There is some automatic variable binding happening in the \POST{} and \GET{}
                however, defaults are always given and there is no possibility of
                accidentally binding extra variables. Also the variables are in an
                array.
                \end{result}
 
-       \item\pass{} Verify that the application has defenses against HTTP
+       \item\pass{} Verify that the application has defenses against \HTTP{}
                parameter pollution attacks, particularly if the application framework
-               makes no distinction about the source of request parameters (GET, POST,
+               makes no distinction about the source of request parameters (\GET{}, \POST{},
                cookies, headers, environment, etc.)
 
                \begin{result}
@@ -132,14 +132,14 @@
                \end{result}
 
        \item\fail{} Verify that all input data is validated, not only \HTML{} form
-               fields but all sources of input such as REST calls, query parameters,
-               HTTP headers, cookies, batch files, RSS feeds, etc; using positive
+               fields but all sources of input such as \REST{} calls, query parameters,
+               \HTTP{} headers, cookies, batch files, \RSS{} feeds, etc; using positive
                validation (whitelisting), then lesser forms of validation such as
                greylisting (eliminating known bad strings), or rejecting bad inputs
                (blacklisting).
 
                \begin{result}
-               REST calls are validated using whitelisting, query parameters are not,
+               \REST{} calls are validated using whitelisting, query parameters are not,
                headers are not, cookies not, batch files are non-existent and RSS feed
                output is not filtered.
                \end{result}