V1.2.1: Verify that output encoding for an HTTP response, HTML document, or XML document is relevant for the context required, such as encoding the relevant characters for HTML elements, HTML attributes, HTML comments, CSS, or HTTP header fields, to avoid changing the message or document structure.
ASVS Maturity
V1.2.2
V1.2.2: Verify that when dynamically building URLs, untrusted data is encoded according to its context (e.g., URL encoding or base64url encoding for query or path parameters). Ensure that only safe URL protocols are permitted (e.g., disallow javascript: or data:).
ASVS Maturity
V1.2.3
V1.2.3: Verify that output encoding or escaping is used when dynamically building JavaScript content (including JSON), to avoid changing the message or document structure (to avoid JavaScript and JSON injection).
ASVS Maturity
V1.2.4
V1.2.4: Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.
ASVS Maturity
V1.2.5
V1.2.5: Verify that the application protects against OS command injection and that operating system calls use parameterized OS queries or use contextual command line output encoding.
ASVS Maturity
V1.2.6
V1.2.6: Verify that the application protects against LDAP injection vulnerabilities, or that specific security controls to prevent LDAP injection have been implemented.
ASVS Maturity
V1.2.7
V1.2.7: Verify that the application is protected against XPath injection attacks by using query parameterization or precompiled queries.
ASVS Maturity
V1.2.8
V1.2.8: Verify that LaTeX processors are configured securely (such as not using the "--shell-escape" flag) and an allowlist of commands is used to prevent LaTeX injection attacks.
ASVS Maturity
V1.2.9
V1.2.9: Verify that the application escapes special characters in regular expressions (typically using a backslash) to prevent them from being misinterpreted as metacharacters.
ASVS Maturity
V1.2.10
V1.2.10: Verify that the application is protected against CSV and Formula Injection. The application must follow the escaping rules defined in RFC 4180 sections 2.6 and 2.7 when exporting CSV content. Additionally, when exporting to CSV or other spreadsheet formats (such as XLS, XLSX, or ODF), special characters (including '=', '+', '-', '@', '\t' (tab), and '\0' (null character)) must be escaped with a single quote if they appear as the first character in a field value.