File Download
V5.4.1
Verify that the application validates or ignores user-submitted filenames, including in a JSON, JSONP, or URL parameter and specifies a filename in the Content-Disposition header field in the response.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 126, 137, 152, 153, 165, 175, 184, 23, 242, 248, 272, 441, 444, 48, 523, 549, 586, 636, 64, 66
V5.4.2
Verify that file names served (e.g., in HTTP response header fields or email attachments) are encoded or sanitized (e.g., following RFC 6266) to preserve document structure and prevent injection attacks.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 126, 152, 153, 165, 175, 184, 23, 242, 248, 267, 28, 43, 441, 444, 48, 52, 523, 549, 586, 636, 64, 66
V5.4.3
Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent serving of known malicious content.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 122, 126, 175, 184, 23, 233, 242, 248, 253, 441, 444, 523, 549, 636, 66
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
