OWASPASVS 5.0 requirement
ASVS-V1.2.2 When dynamically building urls, untrusted data is encoded according to its context (e.g., url encoding or base64url encoding for query or…
- Standard
- OWASP ASVS 5.0
- Chapter
- V1 Encoding and Sanitization
- Section
- V1.2 Injection Prevention
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that when dynamically building URLs, untrusted data is encoded according to its context (e.g., URL encoding or base64url encoding for query or path parameters). Ensure that only safe URL protocols are permitted (e.g., disallow javascript: or data:).