Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

14.4.7 CWE correction proposal #954

Closed
elarlang opened this issue Mar 30, 2021 · 0 comments
Closed

14.4.7 CWE correction proposal #954

elarlang opened this issue Mar 30, 2021 · 0 comments

Comments

@elarlang
Copy link
Collaborator

Current

14.4.7

  • Requirement: Verify that the content of a web application cannot be embedded in a third-party site by default and that embedding of the exact resources is only allowed where necessary by using suitable Content-Security-Policy: frame-ancestors and X-Frame-Options response headers.
  • CWE: CWE-346: Origin Validation Error

The software does not properly verify that the source of data or communication is valid.

Proposal

Change CWE to CWE-1021: Improper Restriction of Rendered UI Layers or Frames.

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
@elarlang elarlang mentioned this issue Mar 30, 2021
Merged
jmanico added a commit that referenced this issue Mar 30, 2021
@jmanico
Merge pull request #955 from elarlang/asvs-issue-954
c67f462 
fixes #954
elarlang pushed a commit to elarlang/ASVS that referenced this issue Oct 25, 2021
v4.0.3-14.4.7 CWE update (OWASP#954)
6b9ab22
@elarlang elarlang mentioned this issue Oct 25, 2021
Merged
jmanico added a commit that referenced this issue Oct 25, 2021
@jmanico
Merge pull request #1100 from elarlang/v4.0.3-14.4.7
26a520e 
v4.0.3-14.4.7 CWE update (#954)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@elarlang