Safe Deserialization
V1.5.1
Verify that the application configures XML parsers to use a restrictive configuration and that unsafe features such as resolving external entities are disabled to prevent XML eXternal Entity (XXE) attacks.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 19, 201, 23, 242, 250, 271, 66
V1.5.2
Verify that deserialization of untrusted data enforces safe input handling, such as using an allowlist of object types or restricting client-defined object types, to prevent deserialization attacks. Deserialization mechanisms that are explicitly defined as insecure must not be used with untrusted input.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 19, 231, 242, 250
V1.5.3
Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 126, 152, 153, 165, 175, 19, 201, 23, 242, 250, 253, 272, 48, 64, 66, 664
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
