OWASP / OWASP/ASVS

Clarification: 1.3.12 "sanitized"

Open
#3,237 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2) Awaiting response V1 (prev V5)
Dominant language
HTML
Stars
3.6k
Forks
831
Avg merge
7h 55m
Merged PRs (30d)
4

Description

1.3.12 Verify that regular expressions are free from elements causing exponential
backtracking, and ensure untrusted input is sanitized to mitigate ReDoS or
Runaway Regex attacks

Use “escaped or strictly validated” instead of “sanitized,” and mention input length and resource limits. Also add guidance to use safe regex engines or good libraries/tools.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Search the raw .md files in the 5.0 branch for requirement 1.3.12. Review the current wording, then update it to use “escaped or strictly validated,” cover input length and resource limits, and mention safe regex engines or libraries/tools. Done means the requirement includes all requested guidance in the master Markdown source.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, security
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.