一种Web输入验证的鱼骨刺测试模型  

A fishbone test model for Web input validation

作　　者：阚红星[1] 杨善林[1] 袁暋 

机构地区：[1]合肥工业大学管理学院

出　　处：《合肥工业大学学报（自然科学版）》2008年第4期527-530,共4页Journal of Hefei University of Technology：Natural Science

基　　金：国家自然科学基金资助项目(70471046);教育部博士点基金资助项目(20040359004)

摘　　要：文章在分析Web缓冲区溢出、跨站点脚本编写(XSS)、SQL注入和规范化等4种输入攻击原理的基础上,提出一种输入验证的鱼骨刺测试模型。该模型根据每种攻击方式分门别类地设计测试方法和相应的测试用例,对Web各个交互文本框输入的数据进行全方位测试。同现有的方法相比,该模型对Web的测试更加全面,能有效防止多种Web攻击。A fishbone test model for Web input validation is presented based on the analysis of four kinds of Web attacks including buffer overflow, XSS, SQL injection, and normalization. In order to prevent attacks from the persons with evil intention, strict input validation for every entering must be carried out. In the model,according to the attacking ways, some test methods and corresponding test cases are designed to test all kinds of data that come from Web input. Compared with the existing methods, this test model can prevent many kinds of Web attacks more effectively.

关 键 词：WEB攻击 输入验证 鱼骨刺 测试模型 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]