M1170
Mitigation
Mitigation Use parameterized queries A parameterized query is a query in which placeholders are used for parameters and the parameter values are supplied at execution time.
Parameterized queries ensure that an attacker is not able to change the intent of a query, even if SQL commands are inserted by an attacker. Note that parametrized queries should be done on the server-side. Every language supports their own constructions, please use the references to find appropriate mechanism for your technologies.
M1171
Mitigation
Mitigation Use stored procedures A stored procedure is a set of Structured Query Language (SQL) statements with an assigned name, which are stored in a database, so it can be reused and shared by multiple applications.
A stored procedure provides an important layer of security between the user interface and the database. It supports security through data access controls because end users may enter or change data, but do not write procedures. A stored procedure preserves data integrity because information is entered in a consistent manner. Note that safely implemented stored procedure does not include any unsafe dynamic SQL generation.
M1172
Mitigation
Mitigation Use allow-list input validation Input validation is performed to ensure only properly formed data is entering the workflow in an information system, preventing malformed data from persisting in the database and triggering malfunction of various downstream components.
Input validation should happen as early as possible in the data flow, preferably as soon as the data is received from the external party. Allow list validation is appropriate for all input fields provided by the user. Allow list validation involves defining exactly what IS authorized, and by definition, everything else is not authorized.
M1173
Mitigation
Mitigation Escape all user supplied input This technique should only be used as a last resort, when none of the above are feasible.
Escape user input before putting it in a query. Each DBMS supports one or more character escaping schemes specific to certain kinds of queries. If you then escape all user supplied input using the proper escaping scheme for the database you are using, the DBMS will not confuse that input with SQL code written by the developer, thus avoiding any possible SQL injection vulnerabilities.
M1883
Mitigation
Mitigation Implement Web Application Firewall A web application firewall (WAF) is a security control that is designed to protect web applications from various types of cyber threats, such as web-based attacks, including Cross-Site Scripting (XSS), SQL Injection, Cross-Site Request Forgery (CSRF), and other application-layer attacks.
A WAF acts as a filter between a web application and the incoming requests from clients, such as web browsers or mobile apps. It examines the incoming requests and responses to and from the web application, and applies a set of predefined security rules to identify and block malicious requests or traffic.
