From 2636f01cf8f71d19ccfa7176a63ce96f697ddf1f Mon Sep 17 00:00:00 2001 From: khalidwalamri Date: Mon, 7 Sep 2026 09:30:48 +0300 Subject: [PATCH 1/3] Reword 1.3.5 to focus on unwanted dynamic behavior Applies the wording agreed by the project leaders in #3235. The previous text ("sanitizes or disables ... or similar") was unclear about what "disable" means in this context, and it conflated technologies with quite different risk profiles: Markdown renders HTML, CSS enables exfiltration and UI redressing, BBCode is a parsing risk, and XSLT can execute code. The agreed wording reframes the requirement around preventing unwanted dynamic behavior, treating built-in parser and processor protections as the primary defense and sanitization as the fallback. Tagged [P:WORDING] per the change control conventions in CONTRIBUTING.md, as elarlang confirmed this is a non-breaking change carrying the same meaning and so acceptable for a patch release. Refs #3235 Co-Authored-By: Claude Opus 5 (1M context) --- 5.0/en/0x10-V1-Encoding-and-Sanitization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x10-V1-Encoding-and-Sanitization.md b/5.0/en/0x10-V1-Encoding-and-Sanitization.md index 2a85c33148..69ad83ad9e 100644 --- a/5.0/en/0x10-V1-Encoding-and-Sanitization.md +++ b/5.0/en/0x10-V1-Encoding-and-Sanitization.md @@ -50,7 +50,7 @@ Where this is not possible, sanitization becomes necessary, removing potentially | **1.3.2** | Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed. | 1 | | **1.3.3** | Verify that data being passed to a potentially dangerous context is sanitized beforehand to enforce safety measures, such as only allowing characters which are safe for this context and trimming input which is too long. | 2 | | **1.3.4** | Verify that user-supplied Scalable Vector Graphics (SVG) scriptable content is validated or sanitized to contain only tags and attributes (such as draw graphics) that are safe for the application, e.g., do not contain scripts and foreignObject. | 2 | -| **1.3.5** | Verify that the application sanitizes or disables user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar. | 2 | +| **1.3.5** | [P:WORDING] Verify that the application has protection against unwanted dynamic behavior when using scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode. Where no built-in functionality for preventing this is available or usable, user-supplied input must be sanitized. | 2 | | **1.3.6** | Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service. | 2 | | **1.3.7** | Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | 2 | | **1.3.8** | Verify that the application appropriately sanitizes untrusted input before use in Java Naming and Directory Interface (JNDI) queries and that JNDI is configured securely to prevent JNDI injection attacks. | 2 | From c6c28de2d4ce7e40b0c35dd993cbcf159e3583e0 Mon Sep 17 00:00:00 2001 From: khalidwalamri Date: Mon, 7 Sep 2026 09:39:59 +0300 Subject: [PATCH 2/3] Requirement 1.3.5 rewording --- 5.0/en/0x10-V1-Encoding-and-Sanitization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x10-V1-Encoding-and-Sanitization.md b/5.0/en/0x10-V1-Encoding-and-Sanitization.md index 69ad83ad9e..9455ae3285 100644 --- a/5.0/en/0x10-V1-Encoding-and-Sanitization.md +++ b/5.0/en/0x10-V1-Encoding-and-Sanitization.md @@ -50,7 +50,7 @@ Where this is not possible, sanitization becomes necessary, removing potentially | **1.3.2** | Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed. | 1 | | **1.3.3** | Verify that data being passed to a potentially dangerous context is sanitized beforehand to enforce safety measures, such as only allowing characters which are safe for this context and trimming input which is too long. | 2 | | **1.3.4** | Verify that user-supplied Scalable Vector Graphics (SVG) scriptable content is validated or sanitized to contain only tags and attributes (such as draw graphics) that are safe for the application, e.g., do not contain scripts and foreignObject. | 2 | -| **1.3.5** | [P:WORDING] Verify that the application has protection against unwanted dynamic behavior when using scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode. Where no built-in functionality for preventing this is available or usable, user-supplied input must be sanitized. | 2 | +| **1.3.5** | Verify that the application has protection against unwanted dynamic behavior when using scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode. Where no built-in functionality for preventing this is available or usable, user-supplied input must be sanitized. | 2 | | **1.3.6** | Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service. | 2 | | **1.3.7** | Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | 2 | | **1.3.8** | Verify that the application appropriately sanitizes untrusted input before use in Java Naming and Directory Interface (JNDI) queries and that JNDI is configured securely to prevent JNDI injection attacks. | 2 | From f0a981092dca0ee742d00378510b4c6beea0dee6 Mon Sep 17 00:00:00 2001 From: Khalidwalamri <101907862+khalidwalidalamri@users.noreply.github.com> Date: Mon, 7 Sep 2026 09:50:33 +0300 Subject: [PATCH 3/3] Update wording for security verification step 1.3.5 --- 5.0/en/0x10-V1-Encoding-and-Sanitization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x10-V1-Encoding-and-Sanitization.md b/5.0/en/0x10-V1-Encoding-and-Sanitization.md index 9455ae3285..69ad83ad9e 100644 --- a/5.0/en/0x10-V1-Encoding-and-Sanitization.md +++ b/5.0/en/0x10-V1-Encoding-and-Sanitization.md @@ -50,7 +50,7 @@ Where this is not possible, sanitization becomes necessary, removing potentially | **1.3.2** | Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed. | 1 | | **1.3.3** | Verify that data being passed to a potentially dangerous context is sanitized beforehand to enforce safety measures, such as only allowing characters which are safe for this context and trimming input which is too long. | 2 | | **1.3.4** | Verify that user-supplied Scalable Vector Graphics (SVG) scriptable content is validated or sanitized to contain only tags and attributes (such as draw graphics) that are safe for the application, e.g., do not contain scripts and foreignObject. | 2 | -| **1.3.5** | Verify that the application has protection against unwanted dynamic behavior when using scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode. Where no built-in functionality for preventing this is available or usable, user-supplied input must be sanitized. | 2 | +| **1.3.5** | [P:WORDING] Verify that the application has protection against unwanted dynamic behavior when using scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode. Where no built-in functionality for preventing this is available or usable, user-supplied input must be sanitized. | 2 | | **1.3.6** | Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service. | 2 | | **1.3.7** | Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | 2 | | **1.3.8** | Verify that the application appropriately sanitizes untrusted input before use in Java Naming and Directory Interface (JNDI) queries and that JNDI is configured securely to prevent JNDI injection attacks. | 2 |