OWASP / OWASP/ASVS

Clarification: 1.3.1 WYSIWYG

Open
#3,231 26 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

4) proposal for review V1 (prev V5)
Dominant language
HTML
Stars
3.6k
Forks
831
Avg merge
7h 55m
Merged PRs (30d)
4

Description

1.3.1 Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well‑known and secure HTML sanitization library or framework feature.

  • Sanitization should be done on the server side, not just the client side. This important point is missing from the requirement.
  • Even “secure” well-known libraries can have vulnerabilities.
  • The term “well-known” is subjective. It’s better to recommend libraries with a proven security track record and active maintenance.
  • The security a sanitization library provides depends heavily on how it’s configured,default settings may not be safe or suitable for every use case.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading requirement 1.3.1 in the latest 5.0 raw Markdown, then review the 26-comment discussion on this issue. Done means reaching agreement on precise wording about server-side sanitization, library maintenance and configuration, and updating the requirement accordingly.

Written by the indexing model from the issue text.

Assessment

Tech stack
html
Domain
documentation, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.