12.5.3 grammatical error

[jmanico]

12.5.3	[MODIFIED, MOVED FROM 12.3.4] Verify that the application validates or ignores user-submitted filenames, including in a JSON, JSONP, or URL parameter. The response Content-Type header and Content-Disposition header should be fixed to the file and securely handled by the application instead of the user.

[tghosth]

@set-reminder 3 weeks look at this

[octo-reminder]

⏰ Reminder
Wednesday, December 28, 2022 12:00 AM (GMT+01:00)

look at this

[tghosth]

Based on w3c/webappsec-post-spectre-webdev@f1728a1 and w3c/webappsec-post-spectre-webdev#1 and #1004 and #721 and #1008, I don't think Reflected File Download is a relevant attack any more.

As such, I want to streamline this requirement to be more specific.

[tghosth]

Created #1458

[elarlang]

From proposal 02573dd

#	Description	L1	L2	L3	CWE
12.5.3	[MODIFIED, SPLIT FROM 12.3.4] Verify that the application validates or ignores user-submitted filenames, including in a JSON, JSONP, or URL parameter and specifies a filename in the Content-Disposition header in the response.	✓	✓	✓	641
12.5.4	[MODIFIED, SPLIT FROM 12.3.4] Verify that the Content-Type header is set to the appropriate type for the file being downloaded.	✓	✓	✓	430

I think proposed 12.5.4 is duplicating current 14.4.1:

#	Description	L1	L2	L3	CWE
14.4.1	Verify that every HTTP response contains a Content-Type header. Also specify a safe character set (e.g., UTF-8, ISO-8859-1) if the content types are text/*, /+xml and application/xml. Content must match with the provided Content-Type header.	✓	✓	✓	173

And actually, how relevant the Content-Type header value is for downloaded file? Downloaded file is opened in local operation system based on file extension I guess.

Current 12.5.3 potentially overlaps a bit with #1390

[tghosth]

#1390 should maybe be a new requirement in 12.5.x

Having read this I am still undecided about what the content type should be.

I am however inclined to skip 12.5.4 and rely on 14.4.1 which I agree kinda already covers it.

What do you think?

[octo-reminder]

🔔 @tghosth

look at this