OWASP / OWASP/ASVS

Clarification: 1.3.5 "disable"

Open
#3,235 13 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

6) PR awaiting review requires change control V1 (prev V5)
Dominant language
HTML
Stars
3.6k
Forks
831
Avg merge
7h 55m
Merged PRs (30d)
4

Description

1.3.5 Verify that the application sanitizes or disables user‑supplied scriptable or
expression template language content, such as Markdown, CSS or XSL
stylesheets, BBCode, or similar.

  • I think The term “disable” is unclear, and “sanitize” is too broad and weak.
  • The Server-side processing should also be emphasized
  • It’s also unclear why different execution models and attack vectors, like template/content rendering and expression evaluation—are being grouped together. These are distinct scenarios with different risks, so combining them without clarification makes the requirement harder to understand and apply correctly.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review requirement 1.3.5 in the latest 5.0 master content and read the issue discussion. Clarify what “disable” and “sanitize” mean, address server-side processing, and distinguish the execution models and attack vectors; done when the requirement is precise enough to apply consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
css, markdown
Domain
documentation, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.