OWASP / OpenCRE

https://opencre.org
Creative Commons Zero v1.0 Universal
81 stars 33 forks source link

Input validation missing on import csv functionality #554

Open filipposfwt opened 2 months ago

filipposfwt commented 2 months ago

Issue

When importing a new standard, no validation is performed on the imported csv file, a generic non-descriptive "500 - Internal Server Error" is returned or new CREs are wrongfully injected.

More specifically, in the outlined case, if the format of "CRE 0" column is XX-XXX| instead of XXX-XXX|, a non-descriptive error is returned. Also, I noticed that if in the "|name" column the requirement's text is enclosed between three double quotes '"""', the csv is treated as valid and the whole row is entered as a new root CRE.

image