compliance-owasp 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4e448a6f8c8f74de2ccc664c29d5e369475aa2aea946a9ecd9988baa896bcb69
+  data.tar.gz: '09b3312702f8deefaa42de34fe0e86f08c869681f223c02a2dfef075b135a248'
+SHA512:
+  metadata.gz: efd2cad8e87de1b6986982ae6bbdd77b01dca85cab442b07b2228b9ffe3cff55435a6aebabc7840e0e85db682bbf622646096a35092b35d60e7f9c7414300451
+  data.tar.gz: 3ce5e1521975d8e485ed0882f54a81cecaa231202e874f4ee44fd28a51ab52a5d9ba629b4fd984b42de860a35fa3668e6c2063c72894cc968fb12080323a9bed

data/compliance/OWASP-ASVS-5.0-L1.json

@@ -0,0 +1,612 @@
+{
+  "requirements": [
+    {
+      "id": "OWASP-ASVS-V1.5.1",
+      "description": "Verify that input and output requirements clearly define how to handle and process data based on type and content."
+    },
+    {
+      "id": "OWASP-ASVS-V1.8.1",
+      "description": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels, and ensure that a policy is in place on how to deal with sensitive data."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.1",
+      "description": "Verify that user set passwords are at least 8 characters in length."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.2",
+      "description": "Verify that passwords of at least 64 characters are permitted, and that passwords of more than 128 characters are denied."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.3",
+      "description": "Verify that the application verifies the user's password exactly as received from the user, without any modifications such as truncation or case transformation."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.4",
+      "description": "Verify that any printable Unicode character, including language neutral characters such as spaces and Emojis are permitted in passwords."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.5",
+      "description": "Verify users can change their password."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.6",
+      "description": "Verify that password change functionality requires the user's current and new password."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.7",
+      "description": "Verify that passwords submitted during account registration or password change are checked against an available set of, at least, the top 3000 passwords."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.9",
+      "description": "Verify that there are no password composition rules limiting the type of characters permitted. There should be no requirement for upper or lower case or numbers or special characters."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.11",
+      "description": "Verify that \"paste\" functionality, browser password helpers, and external password managers are permitted."
+    },
+    {
+      "id": "OWASP-ASVS-V2.1.12",
+      "description": "Verify that password input fields use type=password to mask the entry. Applications may allow the user to temporarily view the entire masked password, or the last typed character of the password."
+    },
+    {
+      "id": "OWASP-ASVS-V2.2.1",
+      "description": "Verify that anti-automation controls are effective at mitigating breached credential testing, brute force, and account lockout attacks. Such controls include blocking the most common breached passwords, soft lockouts, rate limiting, CAPTCHA, ever increasing delays between attempts, IP address restrictions, or risk-based restrictions such as location, first login on a device, recent attempts to unlock the account, or similar. More than 5 failed authentication attempts per hour for a single account should trigger some sort of reaction or alert."
+    },
+    {
+      "id": "OWASP-ASVS-V2.2.2",
+      "description": "Verify that restricted authenticators (those using PSTN to deliver OTPs via phone or SMS) are offered only when alternate stronger methods are also offered and when the service provides information on their security risks to users."
+    },
+    {
+      "id": "OWASP-ASVS-V2.2.3",
+      "description": "Verify that users are notified after updates to authentication details, such as credential resets or modification of the username or email address."
+    },
+    {
+      "id": "OWASP-ASVS-V2.2.12",
+      "description": "Verify that email is not used as either a single-factor or multi-factor authentication mechanism."
+    },
+    {
+      "id": "OWASP-ASVS-V2.3.1",
+      "description": "Verify system generated initial passwords or activation codes are securely randomly generated, at least 6 characters long, may contain letters and numbers, expire after a short period of time, and are single-use. These initial secrets must not be permitted to become the long term password."
+    },
+    {
+      "id": "OWASP-ASVS-V2.3.4",
+      "description": "System administrators should not be able to change or choose any user's password, but rather only be able to initiate the password reset process for the user."
+    },
+    {
+      "id": "OWASP-ASVS-V2.5.2",
+      "description": "Verify password hints or knowledge-based authentication (so-called \"secret questions\") are not present."
+    },
+    {
+      "id": "OWASP-ASVS-V2.5.4",
+      "description": "Verify that default user accounts (e.g. \"root\", \"admin\", or \"sa\") are not present in the application or are disabled."
+    },
+    {
+      "id": "OWASP-ASVS-V2.5.6",
+      "description": "Verify forgotten password, and other recovery paths use a secure recovery mechanism, such as time-based OTP (TOTP) or other soft token, mobile push, or another offline recovery mechanism."
+    },
+    {
+      "id": "OWASP-ASVS-V2.5.7",
+      "description": "Verify that if OTP or multi-factor authentication factors are lost, that evidence of identity proofing is performed at the same level as during enrollment."
+    },
+    {
+      "id": "OWASP-ASVS-V2.7.1",
+      "description": "Verify that cleartext out-of-band (NIST \"restricted\") authenticators, such as SMS or PSTN, are not offered by default, and stronger alternatives such as push notifications are offered first."
+    },
+    {
+      "id": "OWASP-ASVS-V2.7.2",
+      "description": "Verify that the out-of-band verifier expires out-of-band authentication requests, codes, or tokens within 10 minutes."
+    },
+    {
+      "id": "OWASP-ASVS-V2.7.3",
+      "description": "Verify that the out-of-band verifier authentication requests, codes, or tokens are only usable once, and only for the original authentication request."
+    },
+    {
+      "id": "OWASP-ASVS-V2.7.4",
+      "description": "Verify that the out-of-band authenticator and verifier communicates over a secure independent channel."
+    },
+    {
+      "id": "OWASP-ASVS-V2.8.1",
+      "description": "Verify that time-based OTPs have a defined lifetime before expiring."
+    },
+    {
+      "id": "OWASP-ASVS-V3.1.2",
+      "description": "Verify that the application performs all session token verification using a trusted, back-end service."
+    },
+    {
+      "id": "OWASP-ASVS-V3.1.3",
+      "description": "Verify that the application uses either cryptographically signed or opaque tokens for session management. Static API secrets and keys should be avoided."
+    },
+    {
+      "id": "OWASP-ASVS-V3.2.1",
+      "description": "Verify the application generates a new session token on user authentication, including re-authentication, and terminates the current session token."
+    },
+    {
+      "id": "OWASP-ASVS-V3.2.2",
+      "description": "Verify that opaque session tokens possess at least 128 bits of entropy."
+    },
+    {
+      "id": "OWASP-ASVS-V3.3.2",
+      "description": "Verify that there is an absolute maximum session lifetime such that re-authentication is required at least every 30 days for L1 applications or every 12 hours for L2 and L3 applications."
+    },
+    {
+      "id": "OWASP-ASVS-V3.4.1",
+      "description": "Verify that cookie-based session tokens have the 'Secure' attribute set."
+    },
+    {
+      "id": "OWASP-ASVS-V3.4.2",
+      "description": "Verify that cookie-based session tokens are not readable by client-side scripts. The session token cookie should have the 'HttpOnly' attribute set and the session token value should only be transferred to the client via the Set-Cookie header."
+    },
+    {
+      "id": "OWASP-ASVS-V3.4.3",
+      "description": "Verify that cookie-based session tokens utilize the 'SameSite' attribute to limit exposure to cross-site request forgery attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V3.4.4",
+      "description": "Verify that cookie-based session tokens use the \"__Host-\" prefix so cookies are only sent to the host that initially set the cookie."
+    },
+    {
+      "id": "OWASP-ASVS-V3.5.3",
+      "description": "Verify that stateless session tokens make use of a digital signature to protect against tampering and this is checked before processing it further."
+    },
+    {
+      "id": "OWASP-ASVS-V3.5.4",
+      "description": "Verify that stateless tokens are checked for expiration before processing them further."
+    },
+    {
+      "id": "OWASP-ASVS-V3.5.5",
+      "description": "Verify that only allow-listed signing algorithms are allowed for a stateless token."
+    },
+    {
+      "id": "OWASP-ASVS-V3.5.6",
+      "description": "Verify that other, security-sensitive attributes of a stateless token are being verified. For example, in a JWT this may include issuer, subject, and audience."
+    },
+    {
+      "id": "OWASP-ASVS-V3.5.7",
+      "description": "Verify that all active stateless tokens, which are being relied upon for access control decisions, are revoked when admins change the entitlements or roles of the user."
+    },
+    {
+      "id": "OWASP-ASVS-V3.7.1",
+      "description": "Verify that the application requires re-authentication or secondary verification before allowing highly sensitive transactions or modifications to account profile or authentication settings."
+    },
+    {
+      "id": "OWASP-ASVS-V3.8.1",
+      "description": "Verify that logout and expiration terminate the user's session, such that the back button or a downstream relying party cannot resume an authenticated session."
+    },
+    {
+      "id": "OWASP-ASVS-V3.8.2",
+      "description": "Verify that the application gives the option to terminate all other active sessions after a successful change or removal of any authentication factor (including password change via reset or recovery and, if present, an MFA settings update)."
+    },
+    {
+      "id": "OWASP-ASVS-V3.8.5",
+      "description": "Verify that the application terminates all active sessions when a user account is disabled or deleted (such as an employee leaving the company)."
+    },
+    {
+      "id": "OWASP-ASVS-V3.8.6",
+      "description": "Verify that application administrators are able to terminate active sessions for an individual user or for all users."
+    },
+    {
+      "id": "OWASP-ASVS-V4.1.1",
+      "description": "Verify that the application enforces access control rules at a trusted service layer and doesn't rely on controls which an untrusted user could manipulate such as client-side JavaScript."
+    },
+    {
+      "id": "OWASP-ASVS-V4.1.2",
+      "description": "Verify that specific controls exist to prevent end users from making changes to access control policy information, such as user roles, permissions, and feature access levels, unless they are explicitly authorized to do so."
+    },
+    {
+      "id": "OWASP-ASVS-V4.1.3",
+      "description": "Verify that the principle of least privilege exists - users should only be able to access functions, data files, URLs, controllers, services, and other resources, for which they possess specific authorization. This implies protection against spoofing and elevation of privilege."
+    },
+    {
+      "id": "OWASP-ASVS-V4.1.5",
+      "description": "Verify that access controls fail securely by denying access, including when an exception occurs."
+    },
+    {
+      "id": "OWASP-ASVS-V4.2.1",
+      "description": "Verify that sensitive data and APIs are protected against Insecure Direct Object Reference (IDOR) attacks targeting creation, reading, updating and deletion of records, such as creating or updating someone else's record, viewing everyone's records, or deleting all records."
+    },
+    {
+      "id": "OWASP-ASVS-V4.3.1",
+      "description": "Verify administrative interfaces can only be logically accessed from trusted endpoints or locations. For example, restricting access to bastion or jump hosts, trusted admin workstations or endpoints (e.g., device authentication), administrative LANs, etc."
+    },
+    {
+      "id": "OWASP-ASVS-V5.1.1",
+      "description": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or headers)."
+    },
+    {
+      "id": "OWASP-ASVS-V5.1.2",
+      "description": "Verify that frameworks protect against mass parameter assignment attacks, or that the application has countermeasures to protect against unsafe parameter assignment, such as marking fields private or similar."
+    },
+    {
+      "id": "OWASP-ASVS-V5.1.3",
+      "description": "Verify that all input is validated using positive validation, using an allowed list of values or patterns."
+    },
+    {
+      "id": "OWASP-ASVS-V5.1.4",
+      "description": "Verify that structured data is strongly typed and validated against a defined schema including allowed characters, length and pattern (e.g. credit card numbers, e-mail addresses, telephone numbers, or validating that two related fields are reasonable, such as checking that suburb and zipcode match)."
+    },
+    {
+      "id": "OWASP-ASVS-V5.1.5",
+      "description": "Verify that the application will only automatically redirect the user to a different URL directly from an application URL where the destination appears on an allow list."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.1",
+      "description": "Verify that all untrusted HTML input from WYSIWYG editors or similar is properly sanitized using a well-known and secure HTML sanitization library or framework feature."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.2",
+      "description": "Verify that unstructured data is sanitized to enforce safety measures such as allowed characters and length."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.3",
+      "description": "Verify that the application sanitizes user input before passing to mail systems to protect against SMTP or IMAP injection."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.4",
+      "description": "Verify that the application avoids the use of eval() or other dynamic code execution features. Where there is no alternative, any user input being included must be sanitized or sandboxed before being executed."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.5",
+      "description": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.6",
+      "description": "Verify that the application protects against SSRF attacks, by validating or sanitizing untrusted data or HTTP file metadata, such as filenames and URL input fields, and uses allow lists of protocols, domains, paths and ports."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.7",
+      "description": "Verify that the application sanitizes, disables, or sandboxes user-supplied Scalable Vector Graphics (SVG) scriptable content, especially as they relate to XSS resulting from inline scripts, and foreignObject."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.8",
+      "description": "Verify that the application sanitizes, disables, or sandboxes user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.9",
+      "description": "Verify that the application uses slashes to correctly escape special characters being used in regular expressions to ensure they are not misinterpreted as control characters."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.10",
+      "description": "Verify that regular expressions are free from elements causing exponential backtracking, and ensure untrusted input is sanitized to mitigate ReDoS or Runaway Regex attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V5.2.11",
+      "description": "Verify that the application appropriately sanitizes untrusted input before use in Java Naming and Directory Interface (JNDI) queries and that JNDI is configured as securely as possible to prevent JNDI injection attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V5.3.1",
+      "description": "Verify that output encoding is relevant for the interpreter and context required. For example, use encoders specifically for HTML values, HTML attributes, JavaScript, CSS, URL parameters, HTTP headers, SMTP, and others as the context requires, especially from untrusted inputs (e.g. names with Unicode or apostrophes, such as ねこ or O'Hara)."
+    },
+    {
+      "id": "OWASP-ASVS-V5.3.3",
+      "description": "Verify that context-aware, preferably automated - or at worst, manual - output escaping protects against reflected, stored, and DOM based XSS."
+    },
+    {
+      "id": "OWASP-ASVS-V5.3.4",
+      "description": "Verify that data selection or database queries (e.g. SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from database injection attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V5.3.6",
+      "description": "Verify that the application protects against JSON injection attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V5.3.7",
+      "description": "Verify that the application protects against LDAP injection vulnerabilities, or that specific security controls to prevent LDAP injection have been implemented."
+    },
+    {
+      "id": "OWASP-ASVS-V5.3.8",
+      "description": "Verify that the application protects against OS command injection and that operating system calls use parameterized OS queries or use contextual command line output encoding."
+    },
+    {
+      "id": "OWASP-ASVS-V5.3.10",
+      "description": "Verify that the application protects against XPath injection or XML injection attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V5.3.11",
+      "description": "Verify that the application is protected against CSV and Formula Injection. The application should follow the escaping rules defined in RFC4180 2.6 and 2.7 when exporting CSV files. The application should escape special characters including '=', '+', '-', '@' '\\t' (tab) and '\\00' (null character) using a single quote, if they are the first character in a field, when exporting CSV files and other spreadsheet formats such as xls, xlsx, odf."
+    },
+    {
+      "id": "OWASP-ASVS-V5.5.2",
+      "description": "Verify that the application correctly restricts XML parsers to only use the most restrictive configuration possible and to ensure that unsafe features such as resolving external entities are disabled to prevent XML eXternal Entity (XXE) attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V5.5.3",
+      "description": "Verify that deserialization is not used when communicating with untrusted clients. If this is not possible, ensure that deserialization is performed safely, for example, by only allowing a allow-list of object types or not allowing the client to define the object type to deserialize to, in order to prevent deserialization attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V5.5.4",
+      "description": "Verify that when parsing JSON in browsers or JavaScript-based backends, JSON.parse is used to parse the JSON document. Do not use eval() to parse JSON."
+    },
+    {
+      "id": "OWASP-ASVS-V5.6.1",
+      "description": "Verify that input is decoded or unescaped into a canonical form only once and that this is done before processing the input further, for example it is not performed after input validation or sanitization."
+    },
+    {
+      "id": "OWASP-ASVS-V5.6.2",
+      "description": "Verify that the application is designed to enforce input validation at a trusted service layer. While client-side validation improves usability, security must not rely on it."
+    },
+    {
+      "id": "OWASP-ASVS-V6.2.1",
+      "description": "Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable Padding Oracle attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V7.1.1",
+      "description": "Verify that the application does not log credentials or payment details. Session tokens should only be stored in logs in an irreversible, hashed form."
+    },
+    {
+      "id": "OWASP-ASVS-V7.1.2",
+      "description": "Verify that the application does not log other sensitive data as defined under local privacy laws or relevant security policy."
+    },
+    {
+      "id": "OWASP-ASVS-V7.4.1",
+      "description": "Verify that a generic message is shown when an unexpected or security sensitive error occurs, potentially with a unique ID which support personnel can use to investigate."
+    },
+    {
+      "id": "OWASP-ASVS-V8.2.1",
+      "description": "Verify that the application sets sufficient anti-caching headers (i.e. Cache-Control: no-store) so that sensitive data is not cached in browsers."
+    },
+    {
+      "id": "OWASP-ASVS-V8.2.2",
+      "description": "Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or cookies) does not contain sensitive data, with the exception of session tokens which should be stored in either cookies or sessionStorage."
+    },
+    {
+      "id": "OWASP-ASVS-V8.2.3",
+      "description": "Verify that authenticated data is cleared from client storage, such as the browser DOM, after the client or session is terminated. The \"Clear-Site-Data header\" may be able to help with this but the client-side should also be able to clear up if the server connection is lost."
+    },
+    {
+      "id": "OWASP-ASVS-V8.3.1",
+      "description": "Verify that sensitive data is only sent to the server in the HTTP message body or headers and that the URL and query string do not contain sensitive information, such as an API key or session token."
+    },
+    {
+      "id": "OWASP-ASVS-V8.3.2",
+      "description": "Verify that users have a method to remove their data on demand."
+    },
+    {
+      "id": "OWASP-ASVS-V8.3.3",
+      "description": "Verify that users are provided clear language regarding collection and use of supplied personal information and that users have provided opt-in consent for the use of that data before it is used in any way."
+    },
+    {
+      "id": "OWASP-ASVS-V8.3.10",
+      "description": "Verify that sensitive information is removed from the metadata of user-submitted files unless storage is consented to by the user."
+    },
+    {
+      "id": "OWASP-ASVS-V8.3.11",
+      "description": "Verify that the application does not ask for unnecessary or excessive permissions to privacy related features or sensors, such as cameras, microphones, or location."
+    },
+    {
+      "id": "OWASP-ASVS-V9.1.1",
+      "description": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications."
+    },
+    {
+      "id": "OWASP-ASVS-V9.1.4",
+      "description": "Verify that external facing services use publically trusted TLS certificates."
+    },
+    {
+      "id": "OWASP-ASVS-V9.4.1",
+      "description": "Verify that only the latest recommended cipher suites are enabled, with the strongest cipher suites set as preferred."
+    },
+    {
+      "id": "OWASP-ASVS-V9.4.2",
+      "description": "Verify that only the latest recommended versions of the TLS protocol are enabled, such as TLS 1.2 and TLS 1.3. The latest version of the TLS protocol should be the preferred option."
+    },
+    {
+      "id": "OWASP-ASVS-V9.4.4",
+      "description": "Verify that if TLS wildcard certificates are used, wildcard certificates from a non-production environment are not valid for a production environment."
+    },
+    {
+      "id": "OWASP-ASVS-V10.3.1",
+      "description": "Verify that if the application has a client or server auto-update feature, updates should be obtained over secure channels and digitally signed. The update code must validate the digital signature of the update before installing or executing the update."
+    },
+    {
+      "id": "OWASP-ASVS-V10.3.2",
+      "description": "Verify that the application only loads or executes code, modules, content or plugins from sources not under the application's direct control or protection if it employs integrity protections, such as code signing."
+    },
+    {
+      "id": "OWASP-ASVS-V10.4.1",
+      "description": "Verify that the application explicitly ensures that variables are of the correct type and performs strict equality and comparator operations to avoid type juggling or confusion vulnerabilities caused by the application code making an assumption about a variable type."
+    },
+    {
+      "id": "OWASP-ASVS-V11.1.1",
+      "description": "Verify that the application will only process business logic flows for the same user in sequential step order and without skipping steps."
+    },
+    {
+      "id": "OWASP-ASVS-V11.1.3",
+      "description": "Verify that the application has appropriate limits defined on a per user basis for specific business actions or transactions."
+    },
+    {
+      "id": "OWASP-ASVS-V11.1.5",
+      "description": "Verify that the application has globally defined business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies."
+    },
+    {
+      "id": "OWASP-ASVS-V11.2.1",
+      "description": "Verify that the application will only process business logic flows with all steps being processed in realistic human time, i.e. transactions are not submitted too quickly."
+    },
+    {
+      "id": "OWASP-ASVS-V11.2.2",
+      "description": "Verify that the application has anti-automation controls to protect against excessive calls to application functionality which could result in mass data exfiltration, junk data creation, resource quota exhaustion, rate limit breaches, out-of-band communication flooding, denial of service, overuse of an expensive resource, etc."
+    },
+    {
+      "id": "OWASP-ASVS-V12.1.1",
+      "description": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or denial of service attack."
+    },
+    {
+      "id": "OWASP-ASVS-V12.2.2",
+      "description": "Verify that the application blocks uploaded images with a pixel size larger than the maximum allowed, to prevent pixel flood attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V12.3.1",
+      "description": "Verify that user-submitted filename metadata is not used directly by system or framework filesystems and that a URL API is used to protect against path traversal."
+    },
+    {
+      "id": "OWASP-ASVS-V12.3.2",
+      "description": "Verify that user-submitted filename metadata is validated or ignored to prevent the disclosure, creation, updating or removal of local files (LFI)."
+    },
+    {
+      "id": "OWASP-ASVS-V12.3.3",
+      "description": "Verify that user-submitted filename metadata is validated or ignored to prevent the disclosure or execution of remote files via Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V12.3.7",
+      "description": "Verify that server-side file processing such as file decompression ignores user-provided path information to prevent vulnerabilities such as zip slip."
+    },
+    {
+      "id": "OWASP-ASVS-V12.4.2",
+      "description": "Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent upload and serving of known malicious content."
+    },
+    {
+      "id": "OWASP-ASVS-V12.5.3",
+      "description": "Verify that the application validates or ignores user-submitted filenames, including in a JSON, JSONP, or URL parameter and specifies a filename in the Content-Disposition header in the response."
+    },
+    {
+      "id": "OWASP-ASVS-V13.2.2",
+      "description": "Verify that JSON schema validation is in place and verified before accepting input."
+    },
+    {
+      "id": "OWASP-ASVS-V13.3.1",
+      "description": "Verify that XSD schema validation takes place to ensure a properly formed XML document, followed by validation of each input field before any processing of that data takes place."
+    },
+    {
+      "id": "OWASP-ASVS-V13.5.1",
+      "description": "Verify that WebSocket Secure (wss) is used for all WebSocket connections."
+    },
+    {
+      "id": "OWASP-ASVS-V13.5.2",
+      "description": "Verify that, during the initial HTTP WebSocket handshake, the Origin header is checked against an allow list of authorized origins."
+    },
+    {
+      "id": "OWASP-ASVS-V13.5.3",
+      "description": "Verify that rate limiting is in place for WebSocket messages."
+    },
+    {
+      "id": "OWASP-ASVS-V13.5.4",
+      "description": "Verify that tokens possess at least 128 bits of entropy and are generated using approved cryptographic algorithms if session or channel tokens specific to WebSockets are being used."
+    },
+    {
+      "id": "OWASP-ASVS-V13.5.5",
+      "description": "Verify that the tokens are initially obtained from a response to secure POST request only, and are not sent by the server through the WebSocket connection if session or channel tokens specific to WebSockets are being used."
+    },
+    {
+      "id": "OWASP-ASVS-V13.5.6",
+      "description": "Verify that authentication is done before opening the WebSocket connection if only authenticated users should be able to use WebSockets."
+    },
+    {
+      "id": "OWASP-ASVS-V14.1.6",
+      "description": "Verify that all unneeded features, documentation, sample applications and configurations are removed."
+    },
+    {
+      "id": "OWASP-ASVS-V14.2.1",
+      "description": "Verify that all components are up to date, preferably using a dependency checker during build or compile time."
+    },
+    {
+      "id": "OWASP-ASVS-V14.2.7",
+      "description": "Verify that third party components are sourced separately from internally owned and developed applications to prevent dependency confusion attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V14.3.2",
+      "description": "Verify that debug modes are disabled in production environments for every component to prevent exposure of debug features and unintended information leakage."
+    },
+    {
+      "id": "OWASP-ASVS-V14.3.3",
+      "description": "Verify that the HTTP headers or any part of the HTTP response do not expose detailed version information of server-side components."
+    },
+    {
+      "id": "OWASP-ASVS-V14.3.4",
+      "description": "Verify that directory browsing is disabled unless deliberately desired."
+    },
+    {
+      "id": "OWASP-ASVS-V14.3.5",
+      "description": "Verify that applications do not allow discovery or disclosure of file or directory metadata, such as Thumbs.db, .DS_Store, .git or .svn folders."
+    },
+    {
+      "id": "OWASP-ASVS-V14.3.6",
+      "description": "Verify that the web tier is configured to serve only files with specific file extensions to prevent unintentional information and source code leakage. For example, backup files (e.g. .bak), temporary working files (e.g. .swp), compressed files (.zip, .tar.gz, etc.) and other extensions commonly used by editors should be blocked unless required."
+    },
+    {
+      "id": "OWASP-ASVS-V14.4.1",
+      "description": "Verify that every HTTP response contains a Content-Type header which matches the actual content of the response."
+    },
+    {
+      "id": "OWASP-ASVS-V14.4.8",
+      "description": "Verify that if a response specifies a Content-Type of \"text/\\*\", \"\\*/\\*+xml\" and \"\\*/xml\", it also specifies a safe character set (e.g., UTF-8, ISO-8859-1) with the charset parameter."
+    },
+    {
+      "id": "OWASP-ASVS-V14.5.1",
+      "description": "Verify that the application only responds to HTTP methods in use by the application or by the API (including OPTIONS during preflight requests) and unused methods (e.g. TRACE) are blocked."
+    },
+    {
+      "id": "OWASP-ASVS-V14.5.5",
+      "description": "Verify that HTTP requests using the HEAD, OPTIONS, TRACE or GET verb do not modify any backend data structure or perform any state-changing actions. These requests are safe methods and should therefore not have any side effects."
+    },
+    {
+      "id": "OWASP-ASVS-V14.6.1",
+      "description": "Verify that the value in the Content-Length request header matches the calculated length using the built-in mechanism."
+    },
+    {
+      "id": "OWASP-ASVS-V14.6.2",
+      "description": "Verify that all Transfer-Encoding headers are stripped from the message or that the request is blocked entirely."
+    },
+    {
+      "id": "OWASP-ASVS-V14.6.3",
+      "description": "Verify that a full CRLF (\\r\\n) sequence is neutralized inside a HTTP/2 header."
+    },
+    {
+      "id": "OWASP-ASVS-V14.7.1",
+      "description": "Verify that the web or application server is configured with an allow list of resources or systems to which the server can send requests or load data or files from."
+    },
+    {
+      "id": "OWASP-ASVS-V50.1.1",
+      "description": "Verify that separate applications are hosted on different hostnames to benefit from the restrictions provided by the \"same-origin policy\" including how documents or scripts loaded by one origin can interact with resources from another origin and hostname restrictions on cookies."
+    },
+    {
+      "id": "OWASP-ASVS-V50.2.1",
+      "description": "Verify that a Content Security Policy (CSP) response header is in place that helps mitigate impact for XSS attacks like HTML, DOM, CSS, JSON, and JavaScript injection vulnerabilities."
+    },
+    {
+      "id": "OWASP-ASVS-V50.2.2",
+      "description": "Verify that all responses contain a X-Content-Type-Options: nosniff header."
+    },
+    {
+      "id": "OWASP-ASVS-V50.2.3",
+      "description": "Verify that a Strict-Transport-Security header is included on all responses and for all subdomains, such as Strict-Transport-Security: max-age=31536000; includeSubdomains."
+    },
+    {
+      "id": "OWASP-ASVS-V50.2.4",
+      "description": "Verify that a suitable Referrer-Policy header is included to avoid exposing sensitive information in the URL through the Referer header to untrusted parties."
+    },
+    {
+      "id": "OWASP-ASVS-V50.2.5",
+      "description": "Verify that the content of a web application cannot be embedded in a third-party site by default and that embedding of the exact resources is only allowed where necessary by using suitable Content-Security-Policy: frame-ancestors. Note that the X-Frame-Options solution is obsoleted."
+    },
+    {
+      "id": "OWASP-ASVS-V50.2.6",
+      "description": "Verify that the Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header uses a strict allow list of trusted origins. When \"Access-Control-Allow-Origin: *\" needs to be used, verify that the responses do not include any sensitive information."
+    },
+    {
+      "id": "OWASP-ASVS-V50.3.1",
+      "description": "Verify that the application defends against Cross-Site Request Forgery (CSRF) attacks to protect authenticated or sensitive public functionality using the development framework's built-in anti-CSRF functionality or CSRF tokens plus additional defense in depth measures."
+    },
+    {
+      "id": "OWASP-ASVS-V50.3.3",
+      "description": "Verify that the Origin header is validated against a defined list of allowed origins to match the desired Cross-Origin Resource Sharing (CORS) policy."
+    },
+    {
+      "id": "OWASP-ASVS-V50.4.1",
+      "description": "Verify that JSONP functionality is not enabled anywhere across the application to avoid Cross-Site Script Inclusion (XSSI) attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V50.4.2",
+      "description": "Verify that data requiring authorization is not included in script resource responses, like JavaScript files, to prevent Cross-Site Script Inclusion (XSSI) attacks."
+    },
+    {
+      "id": "OWASP-ASVS-V50.5.1",
+      "description": "Verify that direct requests to uploaded files will never be executed as HTML and JavaScript content."
+    },
+    {
+      "id": "OWASP-ASVS-V50.5.3",
+      "description": "Verify that security controls are in place to prevent browsers from rendering content or functionality in HTTP responses in an incorrect context (e.g., when an API or other resource is loaded directly). Possible controls could include: not serving the content unless headers indicate it is the correct context, Content-Security-Policy: sandbox, Content-Disposition: attachment, etc."
+    },
+    {
+      "id": "OWASP-ASVS-V50.6.1",
+      "description": "Verify that if client-side assets, such as JavaScript libraries, CSS or web fonts, are hosted externally on a Content Delivery Network (CDN) or external provider, Subresource Integrity (SRI) is used to validate the integrity of the asset."
+    }
+  ]
+}