File Storage
V5.3.1
Verify that files uploaded or generated by untrusted input and stored in a public folder, are not executed as server-side program code when accessed directly with an HTTP request.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 126, 165, 175, 184, 19, 23, 242, 248, 253, 441, 444, 523, 549, 636, 66
V5.3.2
Verify that when the application creates file paths for file operations, instead of user-submitted filenames, it uses internally generated or trusted data, or if user-submitted filenames or file metadata must be used, strict validation and sanitization must be applied. This is to protect against path traversal, local or remote file inclusion (LFI, RFI), and server-side request forgery (SSRF) attacks.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 126, 153, 165, 175, 184, 19, 23, 242, 248, 253, 441, 444, 48, 523, 549, 636, 66, 664
V5.3.3
Verify that server-side file processing, such as file decompression, ignores user-provided path information to prevent vulnerabilities such as zip slip.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 126, 153, 165, 175, 19, 23, 253, 48, 66
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
