Injection Prevention
V1.2.1
Verify that output encoding for an HTTP response, HTML document, or XML document is relevant for the context required, such as encoding the relevant characters for HTML elements, HTML attributes, HTML comments, CSS, or HTTP header fields, to avoid changing the message or document structure.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 152, 153, 160, 19, 242, 267, 28, 43, 63
V1.2.2
Verify that when dynamically building URLs, untrusted data is encoded according to its context (e.g., URL encoding or base64url encoding for query or path parameters). Ensure that only safe URL protocols are permitted (e.g., disallow javascript: or data:).
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 137, 152, 153, 160, 19, 242, 267, 272, 28, 43, 586, 63, 64, 72
V1.2.3
Verify that output encoding or escaping is used when dynamically building JavaScript content (including JSON), to avoid changing the message or document structure (to avoid JavaScript and JSON injection).
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 122, 152, 160, 19, 233, 242, 267, 28, 43, 63, 636, 93
V1.2.4
Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 153, 184, 242, 248, 441, 549, 66, 676, 93
V1.2.5
Verify that the application protects against OS command injection and that operating system calls use parameterized OS queries or use contextual command line output encoding.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 153, 184, 242, 248, 441, 549, 88
V1.2.6
Verify that the application protects against LDAP injection vulnerabilities, or that specific security controls to prevent LDAP injection have been implemented.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 136, 153, 184, 242, 248, 441, 549
V1.2.7
Verify that the application is protected against XPath injection attacks by using query parameterization or precompiled queries.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 153, 184, 242, 248, 250, 441, 549, 83
V1.2.8
Verify that LaTeX processors are configured securely (such as not using the "--shell-escape" flag) and an allowlist of commands is used to prevent LaTeX injection attacks.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 153, 184, 242, 248, 441, 549
V1.2.9
Verify that the application escapes special characters in regular expressions (typically using a backslash) to prevent them from being misinterpreted as metacharacters.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 120, 152, 153, 184, 242, 248, 28, 3, 4, 43, 441, 549, 64, 71, 72, 78, 79, 80
V1.2.10
Verify that the application is protected against CSV and Formula Injection. The application must follow the escaping rules defined in RFC 4180 sections 2.6 and 2.7 when exporting CSV content. Additionally, when exporting to CSV or other spreadsheet formats (such as XLS, XLSX, or ODF), special characters (including '=', '+', '-', '@', '\t' (tab), and '\0' (null character)) must be escaped with a single quote if they appear as the first character in a field value.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 153, 184, 242, 248, 28, 3, 43, 441, 52, 549
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
