10. of Elevation of Privilege
There’s no reasonable way for a caller to figure out what security assumptions you make.
|
Threat |
|
|
|
You haven’t documented what you expect your consumers to sanitize before sending it to you, so they are sending you unchecked/unsanitized data, leaving them or you subject to risk if you don’t handle it. |
|
CAPEC |
CAPEC-153 – Input data manipulation |
|
ASVS |
5.1.3 – Validate all untrusted data and use allow lists where possible |
|
CWE |
CWE-1173 – Improper use of the validation framework CWE-183 – Permissive list of allowed inputs CWE-184 – Incomplete list of disallowed inputs CWE CATEGORY – Data neutralization issues | ...
