Clarification 1.1.1: How requirement apply to Single Page Applications (SPA) architectures
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 831
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
Rule: 1.1.1 - Verify that input is decoded or unescaped into a canonical form only once, it is only decoded when encoded data in that form is expected, and that this is done before processing the input further
SPAs often process input at multiple layers (client-side routing, component rendering, API calls, or state management). The requirement mandates decoding before processing, validation, or sanitization, but in an SPA, the boundaries between these steps can be blurred.
The requirement assumes the application can predict when encoded data is expected, but in an SPA, inputs are often processed in a decentralized way (across components, services, or state management), making it hard to enforce this condition uniformly.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading Rule 1.1.1 in the ASVS 5.0 master Markdown and review the issue discussion about SPA processing boundaries. Determine whether the requirement needs clarification for client-side routing, rendering, API calls, or state management; done means the requirement's applicability to SPA architectures is unambiguous.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100