OWASPASVS 5.0 requirement
ASVS-V2.2.1 Input is validated to enforce business or functional expectations for that input.
- Standard
- OWASP ASVS 5.0
- Chapter
- V2 Validation and Business Logic
- Section
- V2.2 Input Validation
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input.