Clarification: 1.3.5 "disable"
Open
Nobody has claimed this yet.
6) PR awaiting review
requires change control
V1 (prev V5)
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 831
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
1.3.5 Verify that the application sanitizes or disables user‑supplied scriptable or
expression template language content, such as Markdown, CSS or XSL
stylesheets, BBCode, or similar.
- I think The term “disable” is unclear, and “sanitize” is too broad and weak.
- The Server-side processing should also be emphasized
- It’s also unclear why different execution models and attack vectors, like template/content rendering and expression evaluation—are being grouped together. These are distinct scenarios with different risks, so combining them without clarification makes the requirement harder to understand and apply correctly.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review requirement 1.3.5 in the latest 5.0 master content and read the issue discussion. Clarify what “disable” and “sanitize” mean, address server-side processing, and distinguish the execution models and attack vectors; done when the requirement is precise enough to apply consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- css, markdown
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100