Suggestion : we should add example against each control for better understanding for developers/security learner.

Suggestion

In my opinion, we should add links or include at least one code example in the control itself. I understand that it might be difficult to provide examples for every programming language, but we could use pseudocode or a general example instead.
For first control :

1.1.1 | Verify that input is decoded or unescaped into a canonical form only once, it is only decoded when encoded data in that form is expected, and that this is done before processing the input further, for example it is not performed after input validation or sanitization.

Code example

`def insecure(user_input):
#step 1 : Validate user input
if '..' in user_input:
   Exception("Blocked")
#step 2 : Decode after validation (bad)! 
decoded_input = decode_input(user_input)
open(decoded_input)

if I pass this input  to insecure method %2e%2e%2fetc%2fpasswd, then it will pass the validation and after decoding the input become '../etc/passwd'

Boom : Path traversal occurs

I think by giving example we can make it easy. I am happy to volunteer and add example where ever possible.
Thanks

Start with the first control, 1.1.1, and review the requested pseudocode example and its path-traversal scenario. Define a consistent format and scope for adding examples or links across the controls. Done means the agreed controls contain understandable examples or links without requiring a specific programming language.