v5.0.0-3.4.5 focus to avoid leakage from 'referer' instead of "have a policy"

Current requirement:

Previously discussed in:

• #2789

Problem to solve:

• The focus point is not fully correct: it requires to have a referrer policy, but it is not required if there are no resources loaded from external addresses and no links provided to external addresses.

Proposal - change to focus to "verify that technically sensitive information is not leaked via the 'Referer' header field"

Verify that the web server configuration or application prevents leakage of technically sensitive data to third-party services via the 'Referer' HTTP request header field. This can be done using the Referrer-Policy HTTP response header field or via HTML element attributes. Sensitive data could include path and query data in the URL, and for internal non-public applications also the hostname.

Proposed changes:

• "application" > "web server configuration or application"
• "sets a referrer policy to prevent" > "prevents"

I consider it not to be a breaking change.

Start by locating requirement 3.4.5 in the ASVS source and review the earlier discussion in issue #2789. Update the requirement wording from requiring a referrer policy to requiring prevention of sensitive information leakage via the Referer header, then verify that the proposed changes match the issue text.