Input Validation
V2.2.1
Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 113, 120, 126, 130, 137, 140, 145, 152, 153, 160, 165, 19, 212, 218, 267, 272, 28, 3, 4, 43, 475, 48, 52, 586, 64, 71, 72, 77, 78, 79, 80
V2.2.2
Verify that the application is designed to enforce input validation at a trusted service layer. While client-side validation improves usability and should be encouraged, it must not be relied upon as a security control.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 113, 126, 130, 137, 140, 145, 152, 153, 162, 165, 19, 201, 202, 207, 212, 218, 22, 271, 272, 28, 43, 475, 48, 554, 586, 77, 87
V2.2.3
Verify that the application ensures that combinations of related data items are reasonable according to the pre-defined rules.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 113, 137, 140, 152, 153, 19, 28
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
