5.2.2 sounds like input validation about asvs HOT 6 OPEN

edit: Maybe should be solved here: #1552

from asvs.

Actually, it's valid requirement. Point for sanitization is, if input validation can not be used, you need to send valid and safe input to next component (downstream) and therefore you need to be sure, that it only contains allowed characters and is with expected/safe length.

from asvs.

Is there any certain problem to discuss or is there a need for improvement? I think it is suitable for "covering all sanitization cases" which does not have separate requirements per situation.

ping @tghosth

from asvs.

You think it is like a catch-all or something? It does seem a little vague...

from asvs.

Verify that unstructured data is sanitized to before being used in any other potentially dangerous context not already listed in this section.

Thought about this but we don't love the fact that it references other requirements.

On the other hand, not sure how to accomplish this as a "last resort/catch-all requirement" without doing so.

from asvs.

Need to think more about it.

from asvs.