Clarification: 1.3.7 "Built"
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 831
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
Verify that the application protects against template injection attacks by not
allowing templates to be built based on untrusted input. Where there is no
alternative, any untrusted input being included dynamically during template
creation must be sanitized or strictly validated.
"built"
What does "built" mean? Many frameworks, templates are dynamic by nature.
"sanitized" or "validated"
Difficult to understand-- What is important and how -- is missing?
I think the sanitization should not be the primary defense in template engines, this is not same as HTML sanitization as far as I know and the requrement doesn't mention the insecure template engines.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the current requirement in the 5.0 raw Markdown and review the 19-comment discussion on what “built,” “sanitized,” and “validated” should mean. Done means the requirement defines these terms and gives actionable guidance without relying on an unspecified template engine.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100