Comments (8)
I tried to remember the logic how to put requirement to different subcategories. We can put them all together, but maybe there is better way and before we do those changes, let's look the options.
Simplified file upload process.
First step - file upload, file reached to the server and now the actions before going to check file actual content
- maximum allowed size should be checked (12.1.1)
- is it known virus (12.4.2) - kept separately from file upload, as you actually need to check viruses also when serving the file
- archive bomb (12.1.2) - you need to check "is it acrhive" and if it is, what is packing ratio. It is before content check, a lot of files are archives, like xlsx, odt.
2nd step - Is it expected file by content (format)?
- is this file expected and allowed by business logic rules (12.2.1)
3rd step - now, file is expected type and content - do it contain something malicious + can server handle it?
- one can argue - that 12.1.2 belongs here
- 12.1.4 - we need to check inside archive file, is there symlink
- proposed pixel bomb - we need to check image dimensions
Now the question is - do we put them all together or is there good and easy to understand naming to keep them separately?
from asvs.
Overall, I think it is easier to split into sections wherever possible. (Please remember to use the Chapter > Section > Requirement terminology, I know I am terrible at remembering this as well 🙃)
I would separate them as follows:
File upload process:
file reached to the server and now the actions before going to check file actual content
- maximum allowed size should be checked (12.1.1)
File Integrity:
Is it expected file by content (format)?
- is this file expected and allowed by business logic rules (12.2.1)
File Content:
3rd step - now, file is expected type and content - do it contain something malicious + can server handle it?
- is it known virus (12.4.2) - kept separately from file upload, as you actually need to check viruses also when serving the file
- archive bomb (12.1.2) - you need to check "is it acrhive" and if it is, what is packing ratio. It is before content check, a lot of files are archives, like xlsx, odt.
- 12.1.4 - we need to check inside archive file, is there symlink
- proposed pixel bomb - we need to check image dimensions
We could make these 3 sections or maybe we should combine the first two into 1 section as they both relate to general expectations about uploaded files as opposed to malicious content
from asvs.
Let's put "V12.3 File execution" in to the game. Entire this section needs work (#1427), but there we have requirement, like zip slip (12.3.7).
If we protect the application, then pixel flood requirement belongs here.
So the outcome from this issue should be - which sections we have and what are the criterias for requirements to belong to some section.
from asvs.
Hmm, @elarlang do you think we have enough different V12 issues that we should defer to the rework stage?
from asvs.
I think I can not understand the question.
First priority should be to get requirements in, then we can see what are the needs or possibility for making sections out of those.
from asvs.
I mean, is this issue now affecting pretty much the whole chapter and therefore best left to when we are working on the whole chapter together at the rework stage?
from asvs.
Yes, this issue is not priority and is logical outcome when we get more requirements in.
First priority should be to get requirements in, then we can see what are the needs or possibility for making sections out of those.
... and I start hating the phrase "rework stage" already :)
from asvs.
... and I start hating the phrase "rework stage" already :)
I hear that but I think it helps us come to some sort of conclusion on issues and set ourselves up for the actual rewrite.
from asvs.
Related Issues (20)
- 2.7.5 is a security problem and weakness HOT 8
- 2.7.6 and 2.7.7 are in conflict HOT 6
- discussion/proposal: disallow user-autologin to an application using SSO sessions HOT 3
- Inclusion of Cypher Injection Prevention for Neo4j in ASVS 5.3.4 HOT 2
- Add requirement about usage of claims other than subject and issuer as an identifier for OpenID Connect HOT 21
- [ASVS 5.0] Fix typos, punctuation, grammar, and standardize spelling to US English HOT 3
- Fingerprinting devices/matching sessions to a device. HOT 9
- `tlmgr` sometimes fails to update
- Most recent artifacts HOT 3
- Warnings on github actions HOT 3
- `install-unx.sh` intermittent failure
- 1.2.2 "User Account" is troubling HOT 3
- 1.2.5 HOT 1
- 2.2.11 HOT 1
- 2.3.1 seems weak HOT 1
- 13.4.2 seems too broad and not testable HOT 23
- 13.5.3 rate limiting should apply to all APIs HOT 8
- client should not send longer request headers than server can accept HOT 6
- new V5 section for architecture requirements HOT 2
- Requesting Clarifying Definition in the Business Logic Section Header HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from asvs.