OWASPASVS 5.0 requirement
ASVS-V5.3.2 When the application creates file paths for file operations, instead of user-submitted filenames, it uses internally generated or trusted…
- Standard
- OWASP ASVS 5.0
- Chapter
- V5 File Handling
- Section
- V5.3 File Storage
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that when the application creates file paths for file operations, instead of user-submitted filenames, it uses internally generated or trusted data, or if user-submitted filenames or file metadata must be used, strict validation and sanitization must be applied. This is to protect against path traversal, local or remote file inclusion (LFI, RFI), and server-side request forgery (SSRF) attacks.