Recently we had an issue on our site where someone attempted SQL injection via a cookie (we'll call it
lastID). NOC was in a frenzy and angry about how the cookie as an attack vector could be ignored. They had a developer create a class for managing cookies that will sanitize
lastID (and eventually other cookies) to check that it is numeric.
However, I think that this is wrong. The problem wasn't that
lastID wasn't numeric, it was that the query that uses it was vulnerable to injection. I'm in charge of the review of the code changes, and I want to bring up the fact that forcing
lastID to be numeric is not particularly useful and perhaps even undesirable.
Is there a term or concept that describes sanitizing at the right time (i.e. sanitizing at query time rather than at cookie retrieval time), or "over-sanitizing" (e.g. forcing
lastID to be numeric) that I can use to describe what's happening/should happen in my review? The second part of Postel's Law seems to apply here in my mind:
Be ... liberal in what you accept