OWASP/OpenCRE

Input validation missing on import csv functionality

開放

#554 建立於 2024年9月18日

 (8 則留言) (0 個反應) (1 位負責人)Python (116 個分叉)auto 404
GSOCenhancementgood first issue

倉庫指標

星標
 (167 顆星)
PR 合併指標
 (PR 指標待抓取)

描述

Issue

When importing a new standard, no validation is performed on the imported csv file, a generic non-descriptive "500 - Internal Server Error" is returned or new CREs are wrongfully injected.

More specifically, in the outlined case, if the format of "CRE 0" column is XX-XXX| instead of XXX-XXX|, a non-descriptive error is returned. Also, I noticed that if in the "<standard_name>|name" column the requirement's text is enclosed between three double quotes '"""', the csv is treated as valid and the whole row is entered as a new root CRE.

image

貢獻者指南