trust boundary violation

这个violation 形成的原因，就是mix use trusted and untrusted data in the same data structure. 

14. Trust Boundary Violation

Description: Web applications often mistakenly mix trusted and untrusted data in the same data structures, leading to incidents where unvalidated/unfiltered data is trusted/used.

Fix / Recommendation: Proper input validation and output encoding should be used on data before moving it into trusted boundaries.

Sample Code Snippet:

String sessionPolicyId = request.getParameter("id");
if(sessionPolicyId.matches("[0-9a-zA-Z_]+") {
session.setAttribute("sessionPolicyId",sessionPolicyId);
}

例子里面， sessionPolicyId 没有经过检验，直接传给session, 可能会带来security 的问题。