Home >> Taxonomy >> Asvs 4.0.3 >> 01 architecture design and threat modeling >> 12 secure file upload architecture

Secure File Upload Architecture

V1.12.1

[DELETED, DUPLICATE OF 12.4.1]

Level 1 required: False

Level 2 required: False

Level 3 required: False

CWE:

V1.12.2

Verify that user-uploaded files - if required to be displayed or downloaded from the application - are served by either octet stream downloads, or from an unrelated domain, such as a cloud file storage bucket. Implement a suitable Content Security Policy (CSP) to reduce the risk from XSS vectors or other attacks from the uploaded file.

Level 1 required: False

Level 2 required: True

Level 3 required: True

CWE: 646

Disclaimer:

Credit via OWASP ASVS. For more information visit The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.

View source on GitHub

Loading comments 0%