Output Encoding

Kind: mechanism

Layer: Security Core

Record: architecture:output-encoding

Severity: mandatory

Scope: UI, API, serialization

Canonical: Ontology

A mechanism that escapes values for the context they are written into, such as HTML, SQL or a shell.

Listed in Architecture principles, after Input Validation and before Encryption at Rest.

Requires

• Context-Aware Encoding

Reinforces

• Injection Prevention

Enables

• Safe Rendering

Conflicts with

• Raw Output Rendering

In tension with

• Formatting Flexibility

Tensions

• Output Encoding / Formatting Flexibility

Violated by

• Raw Output Rendering

Refactored by

• Context-Aware Encoding

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Linked from

• Security Privacy Compliance
• Severity levels
• The resolutions