OWASP / OWASP/www-project-api-security-testing-framework
DVGA row 17: deny-list bypass keyword heuristic too narrow
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 150
- Forks
- 41
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 3
Description
Tracked in docs/TRACEABILITY.md, DVGA row 17.
testOperationDenyListBypass (added in #102) only tries a fixed SENSITIVE_FIELD_KEYWORDS list (admin/debug/system-style names) to find a candidate field to test the bypass against. Against DVGA it found no match. Broaden the keyword list or the detection strategy so it's not dependent on guessing the right naming convention.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with testOperationDenyListBypass added in #102 and its fixed SENSITIVE_FIELD_KEYWORDS list; use docs/TRACEABILITY.md row 17 to confirm the expected DVGA behavior. Trace how the test selects a candidate field and broaden the selection or detection so DVGA is covered without relying on one naming convention, then verify the test passes against DVGA.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security, testing-qa
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100