clarifying 5.1.3 about asvs

[elarlang]

Thinking more about it, I think the word "list" is a bit misleading here - it kind of suggests to have a list of accepted values, but in reality, it also means patterns.

My proposal:
Verify that all input is validated using positive validation, using an allowed list of values or patterns.

Also, we need to change the CWE-20 "Improper Input Validation" as it's a class/folder and Vulnerability Mapping: DISCOURAGED

[danielcuthbert]

There's a lot to discuss here but in essence, I agree with your thoughts around moving it into an architecture requirement (because fundamentally it is right, you have to know what you expect and what is known good before you design the feature/function)

I'd see 5.1.3 reading something like

Verify that all input is validated using positive validation (allow lists).

I'm not a fan of specifically calling out HTML here, that is 100% sanitisation and doesn't belong in this and should be elsewhere

[tghosth]

I agree with @danielcuthbert and but I would expand this requirement slightly as we are seeing it was an architectural requirement.

Verify that the application is designed with a centralized input validation capability based on the documented rules which uses positive validation (allow lists).

[elarlang]

Oh please no.

• centralized - it is a completely different requirement and removes focus away from the goal
• documentation in implementation requirement, it must be covered in 1.5.1 (#1552 (comment))

The only point it should carry is the allow-list vs deny-list validation.

[jmanico]

I like it. Very nice Elar.

[tghosth]

Thinking more about it, I think the word "list" is a bit misleading here - it kind of suggests to have a list of accepted values, but in reality, it also means patterns.

My proposal: Verify that all input is validated using positive validation, using an allowed list of values or patterns.

Also, we need to change the CWE-20 "Improper Input Validation" as it's a class/folder and Vulnerability Mapping: DISCOURAGED

ok I can accept the wording @elarlang

I wouldn't bother with a CWE for now.

Are we moving this to 5.6?

[elarlang]

My idea to move it to 5.6 was with a "precondition" to combine the allow-list attitude with sanitiation and then it's over two-chapter requirement and fits to 5.6.

But at the moment it's clearly input validation. For me both solutions are ok.

[tghosth]

Ok so I think we leave it where it is for now

[tghosth]

@elarlang I added some info to the explanatory text at the beginning. What do you think?

Changes:
4644b8e