Output Encoding and Injection Prevention
V5.3.1
Verify that output encoding is relevant for the interpreter and context required. For example, use encoders specifically for HTML values, HTML attributes, JavaScript, URL parameters, HTTP headers, SMTP, and others as the context requires, especially from untrusted inputs (e.g. names with Unicode or apostrophes, such as or O'Hara). (C4)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 116
V5.3.2
Verify that output encoding preserves the user's chosen character set and locale, such that any Unicode character point is valid and safely handled. (C4)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 176
V5.3.3
Verify that context-aware, preferably automated - or at worst, manual - output escaping protects against reflected, stored, and DOM based XSS. (C4)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 79
V5.3.4
Verify that data selection or database queries (e.g. SQL, HQL, ORM, NoSQL) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from database injection attacks. (C3)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 89
V5.3.5
Verify that where parameterized or safer mechanisms are not present, context-specific output encoding is used to protect against injection attacks, such as the use of SQL escaping to protect against SQL injection. (C3, C4)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 89
V5.3.6
Verify that the application protects against JSON injection attacks, JSON eval attacks, and JavaScript expression evaluation. (C4)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 830
V5.3.7
Verify that the application protects against LDAP injection vulnerabilities, or that specific security controls to prevent LDAP injection have been implemented. (C4)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 90
V5.3.8
Verify that the application protects against OS command injection and that operating system calls use parameterized OS queries or use contextual command line output encoding. (C4)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 78
V5.3.9
Verify that the application protects against Local File Inclusion (LFI) or Remote File Inclusion (RFI) attacks.
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 829
V5.3.10
Verify that the application protects against XPath injection or XML injection attacks. (C4)
Level 1 required: True
Level 2 required: True
Level 3 required: True
CWE: 643
Disclaimer:
Credit via OWASP ASVS. For more information visit The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.
