Mitigation
We will now discuss how to prevent or mitigate the vulnerabilities explained in the preceding sections. In short, we'll do the following:
- Follow the principle of least privilege
- Validate all inputs
- Check/harden server configuration
Insecure direct object references
Always favor the use of indirect references. Use nonconsecutive numeric identifiers to reference a table of allowed objects instead of allowing the user to use the object's name directly.
Proper input validation and sanitization of data received from the browser will prevent a path traversal attack. The developer of the application should be careful about taking user input when making filesystem calls. If possible, this should be avoided. A chroot jail involves isolating the application's root directory from the rest of the operating system, and it is a good mitigation technique, but it may be difficult to implement.
For other types of direct object references, the principle of least privilege must be followed. Users should...
