摘要
文章在分析Web缓冲区溢出、跨站点脚本编写(XSS)、SQL注入和规范化等4种输入攻击原理的基础上,提出一种输入验证的鱼骨刺测试模型。该模型根据每种攻击方式分门别类地设计测试方法和相应的测试用例,对Web各个交互文本框输入的数据进行全方位测试。同现有的方法相比,该模型对Web的测试更加全面,能有效防止多种Web攻击。
A fishbone test model for Web input validation is presented based on the analysis of four kinds of Web attacks including buffer overflow, XSS, SQL injection, and normalization. In order to prevent attacks from the persons with evil intention, strict input validation for every entering must be carried out. In the model,according to the attacking ways, some test methods and corresponding test cases are designed to test all kinds of data that come from Web input. Compared with the existing methods, this test model can prevent many kinds of Web attacks more effectively.
出处
《合肥工业大学学报（自然科学版）》
CAS
CSCD
北大核心
2008年第4期527-530,共4页
Journal of Hefei University of Technology：Natural Science
基金
国家自然科学基金资助项目(70471046)
教育部博士点基金资助项目(20040359004)
