AgentSkillsCN

asvs-requirements

OWASP ASVS 5.0 安全审计标准数据库，为全部 17 个 ASVS 领域提供了章节结构、控制目标以及验证要求。

SKILL.md
--- frontmatter
name: asvs-requirements
description: OWASP ASVS 5.0 requirements database for security audits. Provides chapter structure, control objectives, and verification requirements for all 17 ASVS domains.

ASVS 5.0 Requirements

Structured access to OWASP Application Security Verification Standard (ASVS) 5.0 requirements for security auditing.

When to Use This Skill

  • •Planning security audits - To understand which chapters apply to the project
  • •Scoping audit depth - To select appropriate verification level (L1/L2/L3)
  • •Building auditor agents - To define specific checks for each domain
  • •Mapping findings - To reference ASVS requirements in audit reports

When NOT to Use This Skill

  • •Quick vulnerability checks - Use vulnerability-patterns skill instead
  • •Remediation guidance - Use remediation-library skill instead
  • •Non-ASVS audits - Use industry compliance auditors directly

ASVS Verification Levels

LevelNameApplicabilityDepth
L1OpportunisticAll applicationsMinimum baseline
L2StandardMost applicationsRecommended
L3AdvancedHigh-value/critical appsMaximum rigor

Mapping to Audit Modes:

  • •Quick Scan → L1 requirements only
  • •Standard Audit → L1 + L2 requirements
  • •Comprehensive Audit → L1 + L2 + L3 requirements

Chapter Overview

ChapterNameRequirementsPrimary Focus
V1Encoding & Sanitization28Injection prevention
V2Validation & Business Logic15Input validation
V3Web Frontend Security32Browser security
V4API & Web Service17API security
V5File Handling14File security
V6Authentication44Identity verification
V7Session Management18Session security
V8Authorization11Access control
V9Self-contained Tokens7JWT security
V10OAuth & OIDC50OAuth/OIDC security
V11Cryptography32Crypto implementation
V12Secure Communications13TLS/transport
V13Configuration18Secure config
V14Data Protection15Data handling
V15Secure Coding20Code quality
V16Security Logging19Audit logging
V17WebRTC15WebRTC security
Total369

V1: Encoding and Sanitization (28 requirements)

Control Objective

Ensure the application correctly encodes and decodes data to prevent injection attacks.

Sections

  • •V1.1 Encoding Architecture
  • •V1.2 Injection Prevention
  • •V1.3 Sanitization
  • •V1.4 Memory/String Safety
  • •V1.5 Safe Deserialization

Key Requirements

IDLevelRequirement
V1.2.1L1Parameterized queries for all database operations
V1.2.2L1No string concatenation for SQL/NoSQL commands
V1.2.3L1OS command injection prevention
V1.3.1L1HTML output encoding
V1.5.1L1No unsafe deserialization (use JSON)

Detection Patterns

  • •SQL string concatenation: "SELECT * FROM " + table
  • •Command injection: shell invocation with user input
  • •Unsafe deserialize: Python object serialization, PHP unserialize

V2: Validation and Business Logic (15 requirements)

Control Objective

Ensure input validation enforces business expectations and prevents logic bypass.

Sections

  • •V2.1 Documentation
  • •V2.2 Input Validation
  • •V2.3 Business Logic Security
  • •V2.4 Anti-automation

Key Requirements

IDLevelRequirement
V2.2.1L1Server-side validation for all inputs
V2.2.2L1Allowlist validation preferred
V2.3.1L1Sequential step enforcement
V2.4.1L2Rate limiting on sensitive ops

Detection Patterns

  • •Client-only validation: if (form.valid) without server check
  • •Missing rate limiting: No throttle on login/register
  • •Mass assignment: Accepting all form fields without filtering

V3: Web Frontend Security (32 requirements)

Control Objective

Protect browsers against common web attacks through proper headers and configurations.

Sections

  • •V3.1 Documentation
  • •V3.2 Content Interpretation
  • •V3.3 Cookie Setup
  • •V3.4 Security Headers
  • •V3.5 Origin Separation
  • •V3.6 External Resources
  • •V3.7 Other Browser Security

Key Requirements

IDLevelRequirement
V3.3.1L1Cookies: Secure, HttpOnly, SameSite
V3.4.1L1Content-Security-Policy header
V3.4.2L1X-Content-Type-Options: nosniff
V3.4.3L1Strict-Transport-Security (HSTS)
V3.6.1L2Subresource integrity for CDN scripts

Detection Patterns

  • •Missing CSP: No Content-Security-Policy header
  • •Insecure cookies: Missing Secure/HttpOnly flags
  • •No HSTS: Missing Strict-Transport-Security

V4: API and Web Service (17 requirements)

Control Objective

Ensure API endpoints are secure against common attack patterns.

Sections

  • •V4.1 Generic Web Service Security
  • •V4.2 HTTP Message Validation
  • •V4.3 GraphQL
  • •V4.4 WebSocket

Key Requirements

IDLevelRequirement
V4.1.1L1Content-Type header validation
V4.2.1L2HTTP request smuggling prevention
V4.3.1L2GraphQL query depth limiting
V4.3.2L2GraphQL introspection disabled in prod
V4.4.1L2WebSocket authentication

Detection Patterns

  • •GraphQL introspection: introspectionQuery enabled
  • •No depth limit: Unbounded GraphQL queries
  • •Missing auth: WebSocket without handshake validation

V5: File Handling (14 requirements)

Control Objective

Handle files securely throughout upload, storage, and download lifecycle.

Sections

  • •V5.1 Documentation
  • •V5.2 File Upload
  • •V5.3 File Storage
  • •V5.4 File Download

Key Requirements

IDLevelRequirement
V5.2.1L1File extension validation
V5.2.2L1Content-type validation
V5.2.3L1Upload size limits
V5.3.1L1Uploads cannot run as code
V5.4.1L1Path traversal prevention

Detection Patterns

  • •No extension check: Accepting any file type
  • •Path traversal: ../ in filenames not sanitized
  • •Direct run: Uploads served from code directory

V6: Authentication (44 requirements)

Control Objective

Ensure robust authentication mechanisms protect user accounts.

Sections

  • •V6.1 Documentation
  • •V6.2 Password Security
  • •V6.3 General Auth Security
  • •V6.4 Factor Lifecycle
  • •V6.5 Multi-factor Auth
  • •V6.6 Out-of-Band Auth
  • •V6.7 Cryptographic Auth
  • •V6.8 Identity Provider Auth

Key Requirements

IDLevelRequirement
V6.2.1L1Minimum 8 character passwords
V6.2.2L164+ character max allowed
V6.2.3L1Password breach checking
V6.2.4L1Secure hashing (bcrypt/argon2)
V6.3.1L1Account lockout after failures
V6.5.1L2MFA for sensitive operations

Detection Patterns

  • •Weak hashing: MD5/SHA1 for passwords
  • •No lockout: Unlimited login attempts
  • •Plain text: Passwords in logs/storage

V7: Session Management (18 requirements)

Control Objective

Ensure session tokens are generated, managed, and invalidated securely.

Sections

  • •V7.1 Documentation
  • •V7.2 Session Token Lifecycle
  • •V7.3 Session Logout and Timeout
  • •V7.4 Cookie-based Session Management

Key Requirements

IDLevelRequirement
V7.2.1L1Cryptographically random session IDs
V7.2.2L1128+ bit entropy
V7.3.1L1Session invalidation on logout
V7.3.2L2Absolute session timeout
V7.4.1L1Cookie security attributes

Detection Patterns

  • •Predictable IDs: Sequential or timestamp-based
  • •No logout: Missing session invalidation
  • •No timeout: Sessions never expire

V8: Authorization (11 requirements)

Control Objective

Ensure access control is enforced at all levels of the application.

Sections

  • •V8.1 Documentation
  • •V8.2 Application Access Control
  • •V8.3 Directory Browsing and Resource Protection

Key Requirements

IDLevelRequirement
V8.2.1L1Enforce access control on every request
V8.2.2L1IDOR prevention
V8.2.3L1Principle of least privilege
V8.3.1L1Directory listing disabled
V8.3.2L1Sensitive files not accessible

Detection Patterns

  • •Missing IDOR check: Direct object access without ownership validation
  • •Role bypass: Admin functions without role verification
  • •Open directories: Index enabled on sensitive paths

V9: Self-contained Tokens (7 requirements)

Control Objective

Ensure JWT and similar tokens are implemented securely.

Sections

  • •V9.1 Documentation
  • •V9.2 Token Generation
  • •V9.3 Token Verification

Key Requirements

IDLevelRequirement
V9.2.1L1Strong algorithm (RS256/ES256)
V9.2.2L1No "none" algorithm
V9.3.1L1Signature verification
V9.3.2L1Expiration (exp) validation
V9.3.3L2Issuer (iss) validation

Detection Patterns

  • •Weak algorithm: HS256 with weak secret
  • •None algorithm: alg: "none" accepted
  • •No expiry: Missing or ignored exp claim

V10: OAuth and OIDC (50 requirements)

Control Objective

Ensure OAuth 2.0 and OpenID Connect implementations follow security best practices.

Sections

  • •V10.1 Documentation
  • •V10.2 OAuth Client
  • •V10.3 OAuth Authorization Server
  • •V10.4 OAuth Resource Server
  • •V10.5 OIDC Client
  • •V10.6 OIDC Provider

Key Requirements

IDLevelRequirement
V10.2.1L1PKCE for public clients
V10.2.2L1State parameter validation
V10.2.3L1No credentials in URLs
V10.3.1L1Redirect URI validation
V10.5.1L2ID token validation

Detection Patterns

  • •Missing PKCE: Public clients without code_challenge
  • •Open redirect: Insufficient redirect_uri validation
  • •Token in URL: Access token exposed in query params

V11: Cryptography (32 requirements)

Control Objective

Ensure cryptographic implementations use secure algorithms and configurations.

Sections

  • •V11.1 Documentation
  • •V11.2 Key Management
  • •V11.3 Random Values
  • •V11.4 Symmetric Encryption
  • •V11.5 Hashing and Hash-based Functions

Key Requirements

IDLevelRequirement
V11.2.1L1Keys not in source code
V11.3.1L1CSPRNG for security-sensitive values
V11.4.1L2AES-GCM or ChaCha20-Poly1305
V11.5.1L1SHA-256+ for hashing
V11.5.2L2No MD5/SHA1

Detection Patterns

  • •Hardcoded keys: secretKey = "..." in code
  • •Weak PRNG: Math.random() for tokens
  • •Deprecated crypto: DES, RC4, MD5 usage

V12: Secure Communications (13 requirements)

Control Objective

Ensure all communications use secure transport layer protocols.

Sections

  • •V12.1 Documentation
  • •V12.2 TLS Configuration
  • •V12.3 Certificate Validation

Key Requirements

IDLevelRequirement
V12.2.1L1TLS 1.2+ only
V12.2.2L1Strong cipher suites
V12.2.3L2Certificate pinning for mobile
V12.3.1L1Certificate validation enabled
V12.3.2L1No self-signed certs in prod

Detection Patterns

  • •TLS disabled: verify=False, NODE_TLS_REJECT_UNAUTHORIZED=0
  • •Weak TLS: SSLv3, TLS 1.0/1.1 enabled
  • •Self-signed: Non-CA certs in production

V13: Configuration (18 requirements)

Control Objective

Ensure secure default configurations and proper secrets management.

Sections

  • •V13.1 Documentation
  • •V13.2 Build and Deployment Configuration
  • •V13.3 Secrets Management
  • •V13.4 Dependency Management

Key Requirements

IDLevelRequirement
V13.2.1L1Debug disabled in production
V13.2.2L1Error details not exposed
V13.3.1L1Secrets not in version control
V13.3.2L1Secrets not in environment vars (prefer vault)
V13.4.1L2Dependency vulnerability scanning

Detection Patterns

  • •Debug enabled: DEBUG=True in production
  • •Secrets in git: API keys in committed files
  • •Outdated deps: Known vulnerable packages

V14: Data Protection (15 requirements)

Control Objective

Ensure sensitive data is identified, classified, and protected appropriately.

Sections

  • •V14.1 Documentation
  • •V14.2 Data Classification
  • •V14.3 Data at Rest
  • •V14.4 Data in Transit

Key Requirements

IDLevelRequirement
V14.2.1L1Sensitive data identified
V14.3.1L2PII encrypted at rest
V14.3.2L2Database encryption
V14.4.1L1Sensitive data over TLS only

Detection Patterns

  • •Unencrypted PII: Plain text storage of personal data
  • •No column encryption: Sensitive fields not encrypted
  • •HTTP endpoints: Sensitive data sent over HTTP

V15: Secure Coding (20 requirements)

Control Objective

Ensure code follows secure development practices.

Sections

  • •V15.1 Documentation
  • •V15.2 Memory Safety
  • •V15.3 Code Quality
  • •V15.4 Dependency Management

Key Requirements

IDLevelRequirement
V15.2.1L1Buffer overflow prevention
V15.3.1L1No unreachable code
V15.3.2L2Static analysis in CI
V15.4.1L1Known vulnerable deps addressed

Detection Patterns

  • •Buffer issues: Unbounded array access
  • •Dead code: Unreachable branches
  • •Vulnerable deps: CVEs in dependencies

V16: Security Logging (19 requirements)

Control Objective

Ensure security events are logged with appropriate detail for incident response.

Sections

  • •V16.1 Documentation
  • •V16.2 Event Content
  • •V16.3 Log Protection
  • •V16.4 Error Handling

Key Requirements

IDLevelRequirement
V16.2.1L1Authentication events logged
V16.2.2L1Authorization failures logged
V16.3.1L2No sensitive data in logs
V16.3.2L2Log injection prevention
V16.4.1L1Generic error messages to users

Detection Patterns

  • •No auth logging: Login attempts not recorded
  • •PII in logs: Passwords/tokens logged
  • •Verbose errors: Stack traces to users

V17: WebRTC (15 requirements)

Control Objective

Ensure WebRTC implementations are secure.

Sections

  • •V17.1 Documentation
  • •V17.2 WebRTC Security

Key Requirements

IDLevelRequirement
V17.2.1L2DTLS-SRTP encryption
V17.2.2L2ICE candidate restrictions
V17.2.3L2Signaling channel authentication
V17.2.4L2TURN server authentication

Detection Patterns

  • •No encryption: Unencrypted media streams
  • •Open signaling: Unauthenticated signaling server
  • •ICE leaks: Exposing internal IPs

Feature-to-Chapter Mapping

Use this to select relevant chapters based on project features:

Project FeaturePrimary ChaptersSecondary Chapters
authenticationV6V7, V11
oauthV10V6, V9
file-uploadV5V1, V14
apiV4V1, V2, V8
graphqlV4V8
databaseV1, V2V14
websocketsV4, V12V6
paymentsV12, V11V6, V14
frontendV3V1
loggingV16V14

External Resources

See Also

  • •Skill: project-context - Detect project features for chapter selection
  • •Skill: vulnerability-patterns - Language-specific vulnerability patterns
  • •Skill: remediation-library - Fix patterns for findings