This repository has been archived by the owner on Apr 9, 2024. It is now read-only.

Bring up to date with base.#1

Open

bonds0097 wants to merge 2780 commits intopraetorian-inc:masterfrom OWASP:master

+123,272-12

This pull request is big! We're only showing the most recent 250 commits

Commits on Nov 7, 2024

Merge 3.6.2 into 3.6.1 and generalize - resolve #1190 (#2320 )
ryarmst
authored
Clarify 5.5.3 to resolve #2297 (#2323 )
tghosth
authored
rewording anti-automation, change levels #2269 (#2324 )

elarlang
and
jmanico
authored
Resolve #1763 by splitting 2.2.1 (#2319 )
tghosth
authored
Fix v5 headings to resolve #2206 (#2326 )
tghosth
authored
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Align security decision reqs and impl reqs to resolve #2331 (#2333 )

jmanico
and
tghosth
authored
Remove NIST references to a different file to resolve # 2277 (#2332 )
tghosth
authored
Added 1.3.3 to resolve #2102 (#2336 )
ryarmst
authored
Generalize IDP requirement to resolve #2325 (#2335 )
tghosth
authored
Clarify 10.3.1 and move to L3 to resolve #2226 (#2339 )
tghosth
authored
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Minor wording error
tghosth
committed
Merged 13.3 into 13.2 to resolve #2260 (#2338 )

ImanSharaf
and
tghosth
authored
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Adding use-after-free to resolve #2329 (#2343 )

cronchie
and
tghosth
authored
Make 14.1.2 L3 to resolve #2280 (#2341 )

ImanSharaf
and
tghosth
authored
Clarify when PQC algorithms should be used to resolve #2251 (#2345 )
tghosth
authored
Remove 9.4.4 as out of scope to resolve #2312 (#2347 )
tghosth
authored
Trim data protection requirements to resolve #2330 (#2349 )
tghosth
authored
Rephrased the section to make it shorter (#2348 )
ImanSharaf
authored
Rephrased the section to make it shorter (#2346 )

ImanSharaf
and
tghosth
authored
Revert the levels part of this PR (#2351 )
tghosth
authored
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
remove 8.3.9 (v4.0.3-10.2.2) , closes #2350 (#2352 )
elarlang
authored
Asvs corrections vol2 (#2353 )

elarlang
and
Elar Lang
authored

Commits on Nov 8, 2024

Commits on Nov 10, 2024

who stole the table header?

elarlang
authored and
tghosth
committed

Commits on Nov 11, 2024

fix for issue #2366

danielcuthbert
authored and
elarlang
committed
tag
elarlang
committed

Commits on Nov 14, 2024

aud restriction for access token, closes #2182 (#2369 )
elarlang
authored
#2185 - update token time-window validation

Elar Lang
authored and
tghosth
committed
#2368 - move and update requirement for user-consent-for-a-session

Elar Lang
authored and
tghosth
committed
#2184 - update token integrity check

Elar Lang
authored and
tghosth
committed
rm '

elarlang
authored and
tghosth
committed
Add 3.5.7 to resolve 2362

ryarmst
authored and
elarlang
committed

Commits on Nov 16, 2024

#2111 - correct references between 5.3.1 and 51.2.14

Elar Lang
authored and
elarlang
committed

Commits on Nov 18, 2024

added encrypted client hello to 9.4 to resolve #2358 (#2382 )
danielcuthbert
authored
#2151 - authorization_details integrity

Elar Lang
authored and
elarlang
committed
#2182 - audience validation requirements for OAuth resource server (51.4.2) and OIDC client (51.5.4)

Elar Lang
authored and
elarlang
committed
Tweak wording

tghosth
authored and
elarlang
committed

Commits on Nov 19, 2024

Added content for #2314

danielcuthbert
authored and
tghosth
committed
typo in rfc

danielcuthbert
authored and
tghosth
committed
removed cto ref

danielcuthbert
authored and
tghosth
committed
amdned 6.9.1 to be more reflective of PQC status quo

danielcuthbert
authored and
tghosth
committed
fixed linting issues

danielcuthbert
authored and
tghosth
committed
tag fixes

elarlang
authored and
tghosth
committed
addressing PR comments

danielcuthbert
authored and
tghosth
committed
added keywrapping explanation to appendix

danielcuthbert
authored and
tghosth
committed
added NIST PQC FIPS guidelines to appendix

danielcuthbert
authored and
tghosth
committed
ficed 6.6.5 to read more clearly

danielcuthbert
authored and
tghosth
committed
Minor tweak
tghosth
committed
linting
tghosth
committed

Commits on Nov 20, 2024

Resolve #2309 with requirement about validation of client mTLS certificates (#2388 )

authored
Move secret management to configuration chapter to resolve #2130 (#2392 )
tghosth
authored
Clarify 6.7.1
tghosth
committed
Clarify 6.6.5
tghosth
committed
Try and slightly clarify scope of chapters to resolve #2375
tghosth
committed
Crypto crypto inv into 1.6.4 to resolve #685 and merge secrets mgt reqs to resolve #2376
tghosth
authored
V6 corrections

elarlang
authored and
tghosth
committed
#2363 - tokens, check audience

Elar Lang
authored and
tghosth
committed
#2379 - tokens, check type (moved and modified requirement from OAuth chapter)

Elar Lang
authored and
tghosth
committed
#2182 - correction for OAuth specifi 'aud' check

Elar Lang
authored and
tghosth
committed
#2182 - update 51.4.2 - OAuth specific audience check

Elar Lang
authored and
tghosth
committed
#2363 - wording for general token audience requirement

Elar Lang
authored and
tghosth
committed

Commits on Nov 21, 2024

V51, Add requirements about user consent (#2397 )

authored

Commits on Nov 22, 2024

Remove duplicate req to resolve #2402 (#2404 )

danielcuthbert
and
tghosth
authored
Move default accounts to 14.1 to resolve #2394 (#2403 )
tghosth
authored
V5, Remove restrictions on non mentioned algorithms

Gabriel Corona
authored and
tghosth
committed
Crypto appendix: add Salsa20, XChaCha20, BLAKE2, BLAKE3

Gabriel Corona
authored and
tghosth
committed
Crypto appendix: allow HMAC-SHA-1 (#2399 )

authored

Commits on Nov 24, 2024

Delete 3.5.6 and replace with the old 3.5.9 to resolve #1967 (#2405 )
tghosth
authored

Commits on Nov 28, 2024

#2401 - separate section for OAuth consent requirements

elarlang
authored and
tghosth
committed
#2401 - new requirement for managing consents, md table fix

elarlang
authored and
tghosth
committed
numeration fix

elarlang
authored and
tghosth
committed
#2417 - reorder and openid provider chapter title fix

elarlang
authored and
tghosth
committed

Commits on Nov 29, 2024

move cookie section from V3 session management to V50 front-end security (#2418 )

elarlang
and
Elar Lang
authored
Update 0x19-V11-BusLogic.md

jmanico
authored and
elarlang
committed

Commits on Dec 2, 2024

Remove spurious asterisk

Gabriel Corona
authored and
tghosth
committed
Move self-contained token requirements to a dedicated chapter to resolve #2384 (#2429 )
tghosth
authored

Commits on Dec 3, 2024

Fix 'in line' typo

Gabriel Corona
authored and
tghosth
committed

Commits on Dec 6, 2024

#2419 - cookie secure attribute and __Secure- prefix

Elar Lang
authored and
elarlang
committed
#2420 - cookie httponly attribute

Elar Lang
authored and
elarlang
committed
#2421 - cookie samesite attribute

Elar Lang
authored and
elarlang
committed
#2422 - cookie __Host- prefix

Elar Lang
authored and
elarlang
committed
Remove password length denial of service to resolve #1923 (again) (#2438 )
tghosth
authored
Clarify token terminology throughout to resolve #2414 (#2434 )
tghosth
authored
Clarify 9.4.1 about foward secrecy to resolve #2215 (#2439 )
tghosth
authored
eol win > unix

Elar Lang
authored and
elarlang
committed

Commits on Dec 7, 2024

rm reference
elarlang
committed
Fix presentation issues with CCM-8 notes

Gabriel Corona
authored and
tghosth
committed
More precise naming for RSA signature schemes

Gabriel Corona
authored and
tghosth
committed

Commits on Dec 9, 2024

Clarify wording to resolve #2416 (#2444 )
tghosth
authored

Commits on Dec 10, 2024

Commits on Dec 11, 2024

#2428 - should > must, L1 > L2

elarlang
authored and
tghosth
committed
mapping fixes, resolve #2454

Elar Lang
authored and
tghosth
committed

Commits on Dec 12, 2024

Adding clarification on crypto discovery tools to resolve #2395 (#2450 )
tghosth
authored

Commits on Dec 15, 2024

Clarify 6.2.9 wording to resolve #2461

tghosth
authored and
elarlang
committed

Commits on Dec 16, 2024

Commits on Dec 17, 2024

Fixed a number of typos

Robert Bengtsson
authored and
elarlang
committed
Start improving front text (#2365 )
tghosth
authored
Update V3 chapter/section text for 2442 (#2459 )

authored

Commits on Dec 19, 2024

Commits on Jan 1, 2025

Resolve #2467 by splitting and clarifying the 3rd party vuln requirements (#2489 )

tghosth
and
elarlang
authored

Commits on Jan 3, 2025

#2468 - update 50.6.2
elarlang
committed

Commits on Jan 5, 2025

V for Vendet... Verification

Elar Lang
authored and
tghosth
committed
eol fix

Elar Lang
authored and
tghosth
committed
requirement number fix

Elar Lang
authored and
tghosth
committed

Commits on Jan 6, 2025

Commits on Jan 9, 2025

Fix inconsistent tag

tghosth
authored and
elarlang
committed

Commits on Jan 13, 2025

tag update for 1.2.3 / 1.2.4

Elar Lang
authored and
elarlang
committed
tag update for 4.1.2, 4.1.4 / 4.1.3

Elar Lang
authored and
elarlang
committed
as 1.4.3 and 4.1.4 were deleted already for v4.0.3, the label is just DELETED to not have mess with mapping to v5.0

Elar Lang
authored and
elarlang
committed
tag update for 4.1.1 / 4.2.3

Elar Lang
authored and
elarlang
committed
tag update for 1.9.1 / 9.1.1, 9.2.2, 9.3.1

Elar Lang
authored and
elarlang
committed
tag update for 1.9.2 / 9.3.2 - Josh, check as referenced 9.2.3 was deleted

Elar Lang
authored and
elarlang
committed
tag update for 14.5.2 / 4.2.3

Elar Lang
authored and
elarlang
committed
14.3.1 was already delete from v4.0.3, now just DELETED to not have mapping to v5.0

Elar Lang
authored and
elarlang
committed
tag update for 1.14.3 / 1.10.5, 10.6.1

Elar Lang
authored and
elarlang
committed
tag update for 2.2.6 / 2.7.3, 2.8.4

Elar Lang
authored and
elarlang
committed
tag update for 2.4.1 / 6.6.2

Elar Lang
authored and
elarlang
committed
tag update for 2.5.5 / 2.2.3

Elar Lang
authored and
elarlang
committed
tag update for 2.10.3 / 14.8.1

Elar Lang
authored and
elarlang
committed
tag update for 5.3.2 / 13.1.7

Elar Lang
authored and
elarlang
committed
tag update for 5.3.5 / 5.3.4

Elar Lang
authored and
elarlang
committed
tag update for 5.3.6 / 5.3.3

Elar Lang
authored and
elarlang
committed
tag update for 5.5.4 / 5.2.4

Elar Lang
authored and
elarlang
committed
tag update for 6.1.3 / 1.8.1

Elar Lang
authored and
elarlang
committed
tag update for 6.2.3 / 6.5.1, 6.5.2, 6.6.3 - @randomstuff please recheck

Elar Lang
authored and
elarlang
committed
tag update for 6.3.2 / 6.3.1

Elar Lang
authored and
elarlang
committed
tag update for 8.3.7 / 1.8.2

Elar Lang
authored and
elarlang
committed
tag update for 12.3.5 / 5.3.8

Elar Lang
authored and
elarlang
committed
tag update for 12.3.6 / 1.10.2 - Josh recheck

Elar Lang
authored and
elarlang
committed
13.1.2 was already deleted from v4.0.3, no mapping to v5.0

Elar Lang
authored and
elarlang
committed
tag update for 13.1.4 / 4.1.6

Elar Lang
authored and
elarlang
committed
13.2.4 was deleted already for v4.0.3, no mapping for v5.0

Elar Lang
authored and
elarlang
committed
tag update for 13.3.2 / 13.1.6

Elar Lang
authored and
elarlang
committed
7.3.2 and 1.12.1 were deleted already for v4.0.3, no mapping for v5.0

Elar Lang
authored and
elarlang
committed
tag definition change #2515

Elar Lang
authored and
elarlang
committed
Use comma after e.g. and i.e. (#2524 )

authored

Commits on Jan 14, 2025

Commits on Jan 17, 2025

Improve wording in 51.1.1

TobiasAhnoff
authored and
elarlang
committed
Remove the word trusted

TobiasAhnoff
authored and
elarlang
committed

Commits on Jan 19, 2025

Tweak wording for encrypt-then-MAC (6.5.5) (#2533 )
randomstuff
authored

Commits on Jan 21, 2025

fapi link update
elarlang
committed

Commits on Jan 22, 2025

6.6.1, remove mention of SHA-1

randomstuff
authored and
tghosth
committed

Commits on Jan 26, 2025

Mention SRTP in WebRTC crypto req (53.2.2) to resolve #2412 (#2547 )
randomstuff
authored
Clarify CSRF protection req 50.4.1 (#2481 )

tghosth
authored and
elarlang
committed
Merge content type checks into 50.4.3 (#2481 and #2472 )

tghosth
authored and
elarlang
committed
Clarify use of HTTP verbs and move to V50 (#2481 , #2492 )

tghosth
authored and
elarlang
committed
Fix tag and space

tghosth
authored and
elarlang
committed
Add anti-forgery token to glossary

tghosth
authored and
elarlang
committed
Clarify V50.4 section text (#2481 )

tghosth
authored and
elarlang
committed
Clarify tags from 13.2.3

tghosth
authored and
elarlang
committed

Commits on Jan 27, 2025

Add reference for DTLS-SRTP Protection Profiles and update references for the WebRTC DTLS ClientHello DoS (#2550 )
sandrogauci
authored

Commits on Jan 29, 2025

Disapprove usage of CCM-8 (#2534 )
randomstuff
authored

Commits on Jan 30, 2025

Optional - note about V4 UUIDs as they are based on random data (with two bytes reserved for identificaiton)

unprovable
authored and
tghosth
committed
added optional note about PQC ciphers being made available and updated in the appendix.

unprovable
authored and
tghosth
committed
added ref for XChaCha20

unprovable
authored and
tghosth
committed
spellcheck for TDEA - '3TDEA' doesn't exist

unprovable
authored and
tghosth
committed
changed wording - 'MUST' needs a different particle than 'ONLY'

unprovable
authored and
tghosth
committed
added references for BLAKE2 and BLAKE3 hashes

unprovable
authored and
tghosth
committed
added BCrypt ref

unprovable
authored and
tghosth
committed
added note about PQC availability

unprovable
authored and
tghosth
committed
removed HMAC-SHA1 as that's terrible crypto for the modern world

unprovable
authored and
tghosth
committed
changed wording in line with proposal in issue 2448

unprovable
authored and
tghosth
committed
reverting the wording

unprovable
authored and
tghosth
committed
Linting
tghosth
committed

Commits on Feb 2, 2025

Clarify auth code requirements (#2557 )

tghosth
and
elarlang
authored
#2560 - level column to numeric

Elar Lang
authored and
tghosth
committed
Update export scripts
tghosth
committed

Commits on Feb 3, 2025

Make sed command match on 2-4 digit numbers, not 1 digit numbers (#2566 )
tghosth
authored

Commits on Feb 4, 2025

Crypto appendix, remove comment about HMAC-SHA-1

randomstuff
authored and
tghosth
committed

Commits on Feb 5, 2025

OAuth 2.0 BCP RFC released as RFC9700
elarlang
committed

Commits on Feb 6, 2025

change and move 5.1.6 to 10.4

Elar Lang
authored and
elarlang
committed
Fix broken NCSC password link to resolve #2570 (#2574 )
tghosth
authored
6.6.3, Hash function security

randomstuff
authored and
tghosth
committed
move 5.1.5 (leftovers) to 50.8, #2487

Elar Lang
authored and
elarlang
committed

Commits on Feb 8, 2025

Add requirements for authentication strenght

TobiasAhnoff
authored and
elarlang
committed
Remove extra authentication in OIDC Client requirement

TobiasAhnoff
authored and
elarlang
committed

Commits on Feb 9, 2025

Fixing the grammatical errors spotted. (#2583 )
csfreak92
authored

Commits on Feb 11, 2025

Commits on Feb 12, 2025

Split 1.4.7 by level to resolve #2578 (#2612 )
tghosth
authored

Commits on Feb 17, 2025

tweak wording for nist sentance

tghosth
authored and
elarlang
committed