<commit_before># STRIDE
-------

## Description:

STRIDE is a collective for a series of vulnerabilities your applications should
cover in order to harden your applications security.

STRIDE stands for:
Spoofing
Tampering
Repudiation
Information Disclosure
Elevation of privilege

## Solution:

In the context of network security, a spoofing attack is a situation in which one person
or program successfully masquerades as another by falsifying data and thereby gaining an
illegitimate advantage. There are a lot of different types of spoofing you have to take
into account for example: TCP/IP, Referrer, ID, or Email spoofing.

For Tampering we recommend to read the following knowledge base items:

- Input validation
- Input rejection
- Single input validation controls

For Repudiation we recommend to read the following knowledge base items:

- Repudiation attacks

For information disclosure we recommend to read the following knowledge base items:

- Verbose error messaging
- Session information is not stored server-side
- Sensitive information transmitted by unencrypted methods
- Enforce policies for sensitive data processing
- Verify that the session id is never disclosed
- Username enumeration
- Differential analysis

For Elevation of privilege we recommend to read the following knowledge base items:

- Authentication at a central location
- All authentication controls must fail securely
- Client-side authentication
- Re-authentication
- Privilege escalation
- Principle of least privilege
- Authentication at a central location
<commit_msg>Update 172-knowledge_base--STRIDE--.md<commit_after>## Description:

STRIDE is a collective for a series of vulnerabilities your applications should
cover in order to harden your applications security.

STRIDE stands for:
Spoofing
Tampering
Repudiation
Information Disclosure
Elevation of privilege

## Solution:

In the context of network security, a spoofing attack is a situation in which one person
or program successfully masquerades as another by falsifying data and thereby gaining an
illegitimate advantage. There are a lot of different types of spoofing you have to take
into account for example: TCP/IP, Referrer, ID, or Email spoofing.

For Tampering we recommend to read the following knowledge base items:

- Input validation
- Input rejection
- Single input validation controls

For Repudiation we recommend to read the following knowledge base items:

- Repudiation attacks

For information disclosure we recommend to read the following knowledge base items:

- Verbose error messaging
- Session information is not stored server-side
- Sensitive information transmitted by unencrypted methods
- Enforce policies for sensitive data processing
- Verify that the session id is never disclosed
- Username enumeration
- Differential analysis

For Elevation of privilege we recommend to read the following knowledge base items:

- Authentication at a central location
- All authentication controls must fail securely
- Client-side authentication
- Re-authentication
- Privilege escalation
- Principle of least privilege
- Authentication at a central location

{'fraction_non_alphanumeric': 0.032598274209012464, 'fraction_numerical': 0.0009587727708533077, 'mean_word_length': 4.828677839851024, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5998253', 'n_tokens_mistral': 745, 'n_tokens_neox': 712, 'n_words': 408}