Output Encoding and Injection Prevention

V5.3.1

Verify that output encoding is relevant for the interpreter and context required. For example, use encoders specifically for HTML values, HTML attributes, JavaScript, URL parameters, HTTP headers, SMTP, and others as the context requires, especially from untrusted inputs (e.g. names with Unicode or apostrophes, such as or O'Hara). (C4)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 116

V5.3.2

Verify that output encoding preserves the user's chosen character set and locale, such that any Unicode character point is valid and safely handled. (C4)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 176

V5.3.3

Verify that context-aware, preferably automated - or at worst, manual - output escaping protects against reflected, stored, and DOM based XSS. (C4)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 79

V5.3.4

Verify that data selection or database queries (e.g. SQL, HQL, ORM, NoSQL) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from database injection attacks. (C3)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 89

V5.3.5

Verify that where parameterized or safer mechanisms are not present, context-specific output encoding is used to protect against injection attacks, such as the use of SQL escaping to protect against SQL injection. (C3, C4)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 89

V5.3.6

Verify that the application protects against JSON injection attacks, JSON eval attacks, and JavaScript expression evaluation. (C4)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 830

V5.3.7

Verify that the application protects against LDAP injection vulnerabilities, or that specific security controls to prevent LDAP injection have been implemented. (C4)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 90

V5.3.8

Verify that the application protects against OS command injection and that operating system calls use parameterized OS queries or use contextual command line output encoding. (C4)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 78

V5.3.9

Verify that the application protects against Local File Inclusion (LFI) or Remote File Inclusion (RFI) attacks.

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 829

V5.3.10

Verify that the application protects against XPath injection or XML injection attacks. (C4)

Level 1 required: True

Level 2 required: True

Level 3 required: True

CWE: 643

Disclaimer:

Credit via OWASP ASVS. For more information visit The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.

Github logo View source on GitHub

Loading comments 0%

Provided by dotNET lab

This website is created, hosted and provided by dotNET lab. dotNET lab provides training and guidance on secure software development. Contact us to get in touch!

OWASP Cornucopia

OWASP Cornucopia is originally created by Colin Watson. It is open source and can be downloaded free of charge from the OWASP website. It is is free to use. It is licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. OWASP does not endorse or recommend commercial products or services. OWASP Cornucopia is licensed under the Creative Commons Attribution-ShareAlike 3.0 license and is © 2012-2016 OWASP Foundation.