Owasp Data Integrity Failures
Deserialized data from untrusted sources must be validated against a strict schema before use. Software updates, packages, and CI/CD pipeline steps must verify cryptographic signatures.…
$ aoe install @community/principle-owasp-data-integrity-failuresProjection
Always in _index.xml · the agent never has to ask for this.
OwaspDataIntegrityFailures [principle] v1.0.0
OWASP Top 10 A08:2021 (merged Insecure Deserialization + Software and Data Integrity Failures) — code and infrastructure that does not protect against integrity violations in software updates, critical data, and CI/CD pipelines.
Deserialized data from untrusted sources must be validated against a strict schema before use. Software updates, packages, and CI/CD pipeline steps must verify cryptographic signatures. Unsigned or unverified data must never be used to make authorization or code-execution decisions.
Loaded when retrieval picks the atom as adjacent / supporting.
OwaspDataIntegrityFailures [principle] v1.0.0
OWASP Top 10 A08:2021 (merged Insecure Deserialization + Software and Data Integrity Failures) — code and infrastructure that does not protect against integrity violations in software updates, critical data, and CI/CD pipelines.
Deserialized data from untrusted sources must be validated against a strict schema before use. Software updates, packages, and CI/CD pipeline steps must verify cryptographic signatures. Unsigned or unverified data must never be used to make authorization or code-execution decisions.
Meta
- License: LicenseRef-Citation-Only AND Apache-2.0
- License Provenance: package-authorship-claim
Attributed To
OWASP Foundation, Top 10 2021
Applies To
- Deserialization of Java, Python Pickle, PHP unserialize, .NET BinaryFormatter
- npm package integrity (package-lock.json integrity hashes,
npm ci) - CI/CD pipeline artifact signing and verification
- Software update mechanisms (auto-update without signature verification)
- JWT and cookie tamper detection
- CDN-hosted third-party JavaScript (subresource integrity checks)
Counter Examples
- SolarWinds 2020: Orion build server compromised, malicious DLL inserted into signed MSI before code signing step — no independent binary artifact attestation to detect the tampering.
- Python Pickle deserialization:
pickle.loads(user_supplied_bytes)— arbitrary Python execution; used to gain RCE in multiple ML platforms (MLflow, Weights & Biases model registry). - Auto-update client that fetches update over HTTP without signature check — man-in-the-middle delivers malicious installer; confirmed vector in older versions of Squirrel.Windows.
Loaded when retrieval picks the atom as a focal / direct hit.
OwaspDataIntegrityFailures [principle] v1.0.0
OWASP Top 10 A08:2021 (merged Insecure Deserialization + Software and Data Integrity Failures) — code and infrastructure that does not protect against integrity violations in software updates, critical data, and CI/CD pipelines.
Deserialized data from untrusted sources must be validated against a strict schema before use. Software updates, packages, and CI/CD pipeline steps must verify cryptographic signatures. Unsigned or unverified data must never be used to make authorization or code-execution decisions.
Meta
- License: LicenseRef-Citation-Only AND Apache-2.0
- License Provenance: package-authorship-claim
Attributed To
OWASP Foundation, Top 10 2021
Applies To
- Deserialization of Java, Python Pickle, PHP unserialize, .NET BinaryFormatter
- npm package integrity (package-lock.json integrity hashes,
npm ci) - CI/CD pipeline artifact signing and verification
- Software update mechanisms (auto-update without signature verification)
- JWT and cookie tamper detection
- CDN-hosted third-party JavaScript (subresource integrity checks)
Counter Examples
- SolarWinds 2020: Orion build server compromised, malicious DLL inserted into signed MSI before code signing step — no independent binary artifact attestation to detect the tampering.
- Python Pickle deserialization:
pickle.loads(user_supplied_bytes)— arbitrary Python execution; used to gain RCE in multiple ML platforms (MLflow, Weights & Biases model registry). - Auto-update client that fetches update over HTTP without signature check — man-in-the-middle delivers malicious installer; confirmed vector in older versions of Squirrel.Windows.
Sources
Examples
- npm package publishing with provenance attestations (2023): packages published via GitHub Actions include a verifiable build attestation linking the package to the exact commit and workflow — consumers can verify with
npm audit signatures. - Sigstore / cosign: signs container images with keyless signing tied to OIDC identity — every Google distroless image ships with a Rekor transparency log entry verifiable offline.
- Subresource Integrity (SRI):
<script src='cdn.example.com/lib.js' integrity='sha384-...' crossorigin='anonymous'>— browser refuses to execute if hash doesn't match, blocking CDN compromise.
Relations
related: [@community/principle-owasp-cryptographic-failures, @community/principle-owasp-vulnerable-components, @community/rule-secrets-never-in-source]
Source
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
- CVE-2019-14234 (Django insecure deserialization via Pickle in cache backend) — arbitrary code execution if attacker controls cache key.
- SolarWinds Orion supply-chain attack (2020): malicious code injected into signed build artifacts — 18,000 organizations received the trojanized update via trusted update mechanism.
Source
aoe-engine/examples/frontend-design/primes/compiled/@community/principle-owasp-data-integrity-failures/atom.yaml