Skip to content

3235 1.3.5 unwanted dynamic behavior #3404

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
khalidwalamri wants to merge 3 commits into
base: master
Choose a base branch
from
Open

3235 1.3.5 unwanted dynamic behavior #3404

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2636f01
Reword 1.3.5 to focus on unwanted dynamic behavior
khalidwalamri Sep 7, 2026
c6c28de
Requirement 1.3.5 rewording
khalidwalamri Sep 7, 2026
f0a9810
Update wording for security verification step 1.3.5
khalidwalamri Sep 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion 5.0/en/0x10-V1-Encoding-and-Sanitization.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ Where this is not possible, sanitization becomes necessary, removing potentially
| **1.3.2** | Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed. | 1 |
| **1.3.3** | Verify that data being passed to a potentially dangerous context is sanitized beforehand to enforce safety measures, such as only allowing characters which are safe for this context and trimming input which is too long. | 2 |
| **1.3.4** | Verify that user-supplied Scalable Vector Graphics (SVG) scriptable content is validated or sanitized to contain only tags and attributes (such as draw graphics) that are safe for the application, e.g., do not contain scripts and foreignObject. | 2 |
| **1.3.5** | Verify that the application sanitizes or disables user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar. | 2 |
| **1.3.5** | [P:WORDING] Verify that the application has protection against unwanted dynamic behavior when using scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode. Where no built-in functionality for preventing this is available or usable, user-supplied input must be sanitized. | 2 |
| **1.3.6** | Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service. | 2 |
| **1.3.7** | Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | 2 |
| **1.3.8** | Verify that the application appropriately sanitizes untrusted input before use in Java Naming and Directory Interface (JNDI) queries and that JNDI is configured securely to prevent JNDI injection attacks. | 2 |
Expand Down