asvs/v5-file-handling

13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

V5.1.1 File Handling Documentation requirement

Verification requirement 5.1.1 applies at Level 2. It requires documentation to define the permitted file types, expected file extensions, and maximum size (including unpacked size) for each upload feature. The documentation must also specify how files are made safe for end-users to download and process, such as how the application behaves when a malicious file is detected.

V5.2.1 File size processing requirement

Verification requirement 5.2.1 applies at Level 1. The application must only accept files of a size which it can process without causing a loss of performance or a denial of service attack.

V5.2.2 File extension and content validation requirement

Verification requirement 5.2.2 applies at Level 1. When the application accepts a file, either on its own or within an archive such as a zip file, it must check if the file extension matches an expected file extension and validate that the contents correspond to the type represented by the extension. Validation methods include checking the initial 'magic bytes', performing image re-writing, and using specialized libraries for file content validation. For Level 1, this can focus just on files which are used to make specific business or security decisions. For Level 2 and up, this must apply to all files being accepted.

V5.2.3 Compressed file size and count validation requirement

Verification requirement 5.2.3 applies at Level 2. The application must check compressed files (e.g., zip, gz, docx, odt) against maximum allowed uncompressed size and against maximum number of files before uncompressing the file.

V5.2.4 File size quota and count per user requirement

Verification requirement 5.2.4 applies at Level 3. A file size quota and maximum number of files per user must be enforced to ensure that a single user cannot fill up the storage with too many files, or excessively large files.

V5.2.5 Symlink restriction in compressed files requirement

Verification requirement 5.2.5 applies at Level 3. The application must not allow uploading compressed files containing symlinks unless this is specifically required. If symlinks are required, an allowlist of the files that can be symlinked to must be enforced.

V5.2.6 Image pixel size limit requirement

Verification requirement 5.2.6 applies at Level 3. The application must reject uploaded images with a pixel size larger than the maximum allowed, to prevent pixel flood attacks.

V5.3.1 Uploaded file execution prevention requirement

Verification requirement 5.3.1 applies at Level 1. Files uploaded or generated by untrusted input and stored in a public folder must not be executed as server-side program code when accessed directly with an HTTP request.

V5.3.2 File path construction requirement

Verification requirement 5.3.2 applies at Level 1. When the application creates file paths for file operations, it must use internally generated or trusted data instead of user-submitted filenames. If user-submitted filenames or file metadata must be used, strict validation and sanitization must be applied. This is to protect against path traversal, local or remote file inclusion (LFI, RFI), and server-side request forgery (SSRF) attacks.

V5.3.3 Server-side file processing path information requirement

Verification requirement 5.3.3 applies at Level 3. Server-side file processing, such as file decompression, must ignore user-provided path information to prevent vulnerabilities such as zip slip.

V5.4.1 File download filename validation requirement

Verification requirement 5.4.1 applies at Level 2. The application must validate or ignore user-submitted filenames, including in a JSON, JSONP, or URL parameter and must specify a filename in the Content-Disposition header field in the response.

V5.4.2 File download filename encoding and sanitization requirement

Verification requirement 5.4.2 applies at Level 2. File names served (e.g., in HTTP response header fields or email attachments) must be encoded or sanitized (e.g., following RFC 6266) to preserve document structure and prevent injection attacks.

V5.4.3 Antivirus scanning for untrusted files requirement

Verification requirement 5.4.3 applies at Level 2. Files obtained from untrusted sources must be scanned by antivirus scanners to prevent serving of known malicious content.

Give your agent this brain