  Revision as of 17:37, 30 August 2008 by KirstenS (Talk |
contribs)  Jump to: navigation, search  OWASP Testing Guide v3
Table of Contents    Brief Summary  In this test we check
whether it is possible to force the application to loop through
a code segment that needs high computing resources, in order to
decrease its overall performance.  Description of the Issue
The following is an example of vulnerable code in Java:  public
class MyServlet extends ActionServlet {    public void
doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {         . . .
String [] values = request.getParameterValues("CheckboxField");
// lots of logic to process the request         . . .     . . .
Black Box Testing and Examples  If a request is sent to the
server with a number that will, for example, be used to read
many similar name/value pairs (for example, sending “3” to read
input1, input2 and input3 name/value pairs), and if the server
does not enforce a hard upper limit to this