From eabaa242cbea1aee9bf4e5caa40a633a575650ba Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Sat, 3 Aug 2024 19:32:41 +0200 Subject: [PATCH] Update to 12.2.1 https://github.com/OWASP/ASVS/issues/1291 --- 5.0/en/0x20-V12-Files-Resources.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x20-V12-Files-Resources.md b/5.0/en/0x20-V12-Files-Resources.md index 648c95bab..8bc6b2558 100644 --- a/5.0/en/0x20-V12-Files-Resources.md +++ b/5.0/en/0x20-V12-Files-Resources.md @@ -22,7 +22,7 @@ Although zip bombs can be effectively tested using penetration testing technique | # | Description | L1 | L2 | L3 | CWE | | :---: | :--- | :---: | :---: | :---: | :---: | -| **12.2.1** | [MODIFIED] Verify that when the application is accepting a file, it checks that the file extension of the file matches an expected file extension and that it validates that the contents of the file match the type represented by that extension, including but not limited to checking the initial "magic bytes". | | ✓ | ✓ | 434 | +| **12.2.1** | [MODIFIED] Verify that when the application accepts a file, it checks if the file extension matches an expected file extension and validates that the contents correspond to the type represented by the extension. This includes, but is not limited to, checking the initial 'magic bytes', performing image re-writing, and using specialized libraries for file content validation. | | ✓ | ✓ | 434 | | **12.2.2** | [ADDED] Verify that the application blocks uploaded images with a pixel size larger than the maximum allowed, to prevent pixel flood attacks. | ✓ | ✓ | ✓ | 400 | ## V12.3 File Execution