Skip to content

Commit

Permalink
V for Vendet... Verification
Browse files Browse the repository at this point in the history
  • Loading branch information
Elar Lang committed Jan 2, 2025
1 parent f6dd15d commit 0c824c9
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
4 changes: 2 additions & 2 deletions 5.0/en/0x18-V10-Coding.md
Original file line number Diff line number Diff line change
Expand Up @@ -65,13 +65,13 @@ Complying with this section is likely to be operational and continuous.
| **10.4.6** | [ADDED] Verify that the application is able to discern and utilizes the user's true IP address to provide for sensitive functions, including rate limiting and logging. | ||| 348 |
| **10.4.7** | [MODIFIED, MOVED FROM 5.1.1, LEVEL L1 > L2] Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields). | ||| 235 |

## 10.5 Security Architecture
## V10.5 Security Architecture

| # | Description | L1 | L2 | L3 | CWE |
| :---: | :--- | :---: | :---: | :---: | :---: |
| **10.5.1** | [ADDED, SPLIT FROM 1.14.5, 14.2.6] Verify that the application implements additional protections around parts of the application which are documented as performing "risky" operations or using "risky" third-party libraries. This could include techniques such as sandboxing, encapsulation, containerization or network level isolation to delay and deter attackers who compromise one part of an application from pivoting elsewhere in the application. | | || |

## 10.6 Code Dependencies
## V10.6 Code Dependencies

Dependency management is critical to the safe operation of any application of any type. Failure to keep up to date with outdated or insecure dependencies is the root cause of the largest and most expensive attacks to date. While being up-to-date with patches is essential, relying solely on updates for publicly disclosed vulnerabilities introduces risk, as vendors may fix security issues without public announcements.

Expand Down
2 changes: 1 addition & 1 deletion 5.0/en/0x19-V11-BusLogic.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ Business logic security is so individual to every application that no one checkl
| **11.2.1** | [MODIFIED, MOVED FROM 11.1.2, LEVEL L1 > L3] Verify that business logic processes require realistic human timing, preventing excessively rapid transaction submissions. | | || 799 |
| **11.2.2** | [MODIFIED, MOVED FROM 11.1.4, LEVEL L1 > L2] Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage data creation, quota exhaustion, rate limit breaches, denial of service, or overuse of costly resources. | ||| 770 |

## 11.3 Input Validation
## V11.3 Input Validation

| # | Description | L1 | L2 | L3 | CWE |
| :---: | :--- | :---: | :---: | :---: | :---: |
Expand Down

0 comments on commit 0c824c9

Please sign in to comment.