forked from OWASP/ASVS
-
Notifications
You must be signed in to change notification settings - Fork 0
/
OWASP Application Security Verification Standard 4.0.3-zh-cn.flat.json
3722 lines (3722 loc) · 132 KB
/
OWASP Application Security Verification Standard 4.0.3-zh-cn.flat.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
"requirements": [
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.1",
"section_name": "安全软件开发生命周期",
"req_id": "V1.1.1",
"req_description": "验证使用安全的软件开发生命周期，在开发的各个阶段解决安全问题。 ([C1](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.1",
"section_name": "安全软件开发生命周期",
"req_id": "V1.1.2",
"req_description": "验证在每次设计变更或sprint计划中使用威胁建模，以识别威胁、计划对策、促进适当的风险响应，并指导安全测试。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "1053",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.1",
"section_name": "安全软件开发生命周期",
"req_id": "V1.1.3",
"req_description": "验证所有用户信息和功能是否包含功能安全约束，例如 “作为一个用户，我应该能够查看和编辑我的个人资料。我不应该能够查看或编辑其他人的资料”",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "1110",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.1",
"section_name": "安全软件开发生命周期",
"req_id": "V1.1.4",
"req_description": "验证应用程序所有的信任边界、组件和重要数据流的文档，判断其合理性。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "1059",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.1",
"section_name": "安全软件开发生命周期",
"req_id": "V1.1.5",
"req_description": "验证应用程序的高级架构及远程连接服务涉及的定义和安全分析。 ([C1](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "1059",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.1",
"section_name": "安全软件开发生命周期",
"req_id": "V1.1.6",
"req_description": "验证集中、简单（设计）、安全、经过审查、和可重复使用的安全控制措施的实施情况，以避免重复、缺失、无效或不安全的控制措施。 ([C10](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "637",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.1",
"section_name": "安全软件开发生命周期",
"req_id": "V1.1.7",
"req_description": "向所有开发人员和测试人员，验证安全编码Checklist、安全需求、指南或策略的可用性。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "637",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.2",
"section_name": "认证架构",
"req_id": "V1.2.1",
"req_description": "验证应用程序所有的组件、服务和服务器，是否使用了唯一或特殊的低权限操作系统帐户。 ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "250",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.2",
"section_name": "认证架构",
"req_id": "V1.2.2",
"req_description": "验证应用组件之间（包括 API、中间件和数据层）的通信是否经过验证。组件只具有最低的必要权限。 ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "306",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.2",
"section_name": "认证架构",
"req_id": "V1.2.3",
"req_description": "验证应用程序是否使用已知安全的单一认证机制，可以扩展到强身份验证，并有足够的日志记录和监控，来检测帐户滥用或违规行为。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "306",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.2",
"section_name": "认证架构",
"req_id": "V1.2.4",
"req_description": "验证所有的认证途径和身份管理 API ，都实现了一致的认证安全控制强度， 以便收敛应用程序的风险。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "306",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.4",
"section_name": "访问控制架构",
"req_id": "V1.4.1",
"req_description": "验证受信任的实施点（如访问控制网关、服务器和Serverless函数）是否实施了访问控制。切勿在客户端实施访问控制。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "602",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.4",
"section_name": "访问控制架构",
"req_id": "V1.4.2",
"req_description": "[已删除，不可操作]",
"level1": "",
"level2": "",
"level3": "",
"cwe": "",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.4",
"section_name": "访问控制架构",
"req_id": "V1.4.3",
"req_description": "[已删除，与 4.1.3 重复]",
"level1": "",
"level2": "",
"level3": "",
"cwe": "",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.4",
"section_name": "访问控制架构",
"req_id": "V1.4.4",
"req_description": "验证应用程序使用单一的、经过严格审查的访问控制机制，来访问受保护的数据和资源。 所有请求都必须通过这个单一机制，以避免复制、粘贴或不安全的替代路径。 ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "284",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.4",
"section_name": "访问控制架构",
"req_id": "V1.4.5",
"req_description": "验证是否使用基于属性/特征的访问控制，即代码应检查用户对某一特征/数据项的授权，而不仅仅是他们的角色。 权限仍应依照不同角色进行分配。 ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "275",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.5",
"section_name": "输入和输出架构",
"req_id": "V1.5.1",
"req_description": "验证输入和输出要求，明确规定如何根据类型、内容以及适用的法律、法规和其他政策规定，来操作和处理数据。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "1029",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.5",
"section_name": "输入和输出架构",
"req_id": "V1.5.2",
"req_description": "验证在与不受信任的客户进行通信时，不使用序列化。 如果无法做到这一点，请确保执行足够的完整性控制（如果发送敏感数据，可能还要进行加密），以防止反序列化攻击，包括对象注入。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "502",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.5",
"section_name": "输入和输出架构",
"req_id": "V1.5.3",
"req_description": "验证输入验证是否在可信的服务层上执行。 ([C5](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "602",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.5",
"section_name": "输入和输出架构",
"req_id": "V1.5.4",
"req_description": "验证输出编码是否发生在其预期的解释器附近（或由解释器进行）。 ([C4](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "116",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.6",
"section_name": "加密架构",
"req_id": "V1.6.1",
"req_description": "验证是否有明确的加密密钥管理政策，以及加密密钥的生命周期是否遵循密钥管理标准，如NIST SP 800-57。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "320",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.6",
"section_name": "加密架构",
"req_id": "V1.6.2",
"req_description": "验证密码服务的消费者是否通过使用密钥库或基于API的替代方案，来保护密钥材料和其他机密。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "320",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.6",
"section_name": "加密架构",
"req_id": "V1.6.3",
"req_description": "验证所有的密钥和密码是否可替换的，并且是重新加密敏感数据的明确定义流程的一部分。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "320",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.6",
"section_name": "加密架构",
"req_id": "V1.6.4",
"req_description": "验证架构是否将客户端机密（例如对称密钥、密码或 API 令牌）视为不安全的，并且从不使用它们来保护或访问敏感数据。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "320",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.7",
"section_name": "错误、日志和审计架构",
"req_id": "V1.7.1",
"req_description": "验证整个系统是否使用了通用的日志记录格式和方法。 ([C9](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "1009",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.7",
"section_name": "错误、日志和审计架构",
"req_id": "V1.7.2",
"req_description": "验证日志是否安全地传输到远程系统，以便进行分析、检测、报警和升级。 ([C9](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.8",
"section_name": "数据保护和隐私架构",
"req_id": "V1.8.1",
"req_description": "验证所有敏感数据都已识别并归入保护级别。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.8",
"section_name": "数据保护和隐私架构",
"req_id": "V1.8.2",
"req_description": "验证所有保护级别都具有一套相关的保护要求，如加密要求、完整性要求、保留、隐私和其他机密性要求，并在架构中应用这些要求。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.9",
"section_name": "通信架构",
"req_id": "V1.9.1",
"req_description": "验证应用程序对组件之间的通信进行加密，特别是当这些组件处于不同的容器、系统、站点或云提供商时。 ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "319",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.9",
"section_name": "通信架构",
"req_id": "V1.9.2",
"req_description": "验证应用组件是否验证了通信链接中每一方的真实性，以防止中间人攻击。例如，应用程序组件应校验TLS证书链。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "295",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.10",
"section_name": "恶意软件架构",
"req_id": "V1.10.1",
"req_description": "验证是否使用了源代码控制系统，以及有程序确保签入时附带问题或变更单。源代码控制系统应该具有访问控制和可识别的用户，以追溯任何的更改。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "284",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.11",
"section_name": "业务逻辑架构",
"req_id": "V1.11.1",
"req_description": "验证所有应用组件在其提供的业务或安全功能方面的定义和文档。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "1059",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.11",
"section_name": "业务逻辑架构",
"req_id": "V1.11.2",
"req_description": "验证所有高价值的业务逻辑流，包括认证、会话管理和访问控制，不共享不同步的状态。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "362",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.11",
"section_name": "业务逻辑架构",
"req_id": "V1.11.3",
"req_description": "验证所有高价值的业务逻辑流，包括身份验证、会话管理和访问控制都是线程安全的，并能抵抗检查时间和使用时间不同步时的条件竞争。",
"level1": "",
"level2": "",
"level3": "✓",
"cwe": "367",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.12",
"section_name": "安全上传架构",
"req_id": "V1.12.1",
"req_description": "[已删除，与 12.4.1 重复]",
"level1": "",
"level2": "",
"level3": "",
"cwe": "",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.12",
"section_name": "安全上传架构",
"req_id": "V1.12.2",
"req_description": "验证用户上传的文件——如果需要显示或从应用中下载，是通过二进制流下载，或从无关的域（如云文件存储桶）提供。实施合适的内容安全策略（CSP），以减少来自上传文件的XSS向量或其他攻击的风险。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "646",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.14",
"section_name": "配置架构",
"req_id": "V1.14.1",
"req_description": "通过明确的安全控制、防火墙规则、API 网关、反向代理、基于云的安全组或类似机制，验证不同信任级别的组件的隔离情况。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "923",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.14",
"section_name": "配置架构",
"req_id": "V1.14.2",
"req_description": "验证二进制签名、可信连接和经过验证的接口，以将二进制文件部署到远程设备。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "494",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.14",
"section_name": "配置架构",
"req_id": "V1.14.3",
"req_description": "验证构建管道是否对过期或不安全的组件发出警告并采取适当的行动。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "1104",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.14",
"section_name": "配置架构",
"req_id": "V1.14.4",
"req_description": "验证构建管道是否包含自动构建和验证应用安全部署的构建步骤，特别是当应用基础设施是软件定义时，例如云环境构建脚本。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.14",
"section_name": "配置架构",
"req_id": "V1.14.5",
"req_description": "验证应用程序部署是否在网络级别进行了充分的沙盒化、容器化或隔离，以延迟和阻止攻击者攻击其他应用程序，尤其是当攻击者执行敏感或危险操作时（如反序列化）。 ([C5](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "265",
"nist": ""
},
{
"chapter_id": "V1",
"chapter_name": "架构、设计和威胁建模",
"section_id": "V1.14",
"section_name": "配置架构",
"req_id": "V1.14.6",
"req_description": "验证应用程序未使用不受支持、不安全或不推荐的客户端技术，如NSAPI插件、Flash、Shockwave、ActiveX、Silverlight、NACL或客户端Java applets。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "477",
"nist": ""
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.1",
"req_description": "验证用户设置的密码长度至少为 12 个字符（多个空格合并后）。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.2",
"req_description": "验证是否允许64个字符以上的密码，并拒绝超过128个字符的密码。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.3",
"req_description": "验证不进行密码截断。然而，连续的多个空格可以被单个空格代替。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.4",
"req_description": "验证密码中是否允许使用任何可打印的Unicode字符，包括语言中立字符，例如空格和表情符号。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.5",
"req_description": "验证用户可以更改其密码。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "620",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.6",
"req_description": "验证密码更改功能是否需要用户的当前密码和新密码。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "620",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.7",
"req_description": "验证在账户注册、登录和密码更改过程中提交的密码，是否出现在被泄露过的密码中，这些密码可以是本地的（如符合系统密码策略的前1000个或10000个最常见的密码），也可以使用外部API。 如果使用API，应使用零知识证明或其他机制，以确保纯文本密码不被发送或用于验证密码的违反状态。 如果密码被泄露，应用程序必须要求用户设置一个新的未被泄露的密码。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.8",
"req_description": "验证是否提供了密码强度表，以帮助用户设置更强的密码。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.9",
"req_description": "验证是否有限制允许的字符类型的密码组成规则。对大写或小写、数字或特殊字符不应有任何要求。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.10",
"req_description": "验证没有定期更换凭证或密码历史的要求。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "263",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.11",
"req_description": "验证是否允许 “粘贴” 功能、浏览器密码辅助工具和外部密码管理器。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.1",
"section_name": "密码安全",
"req_id": "V2.1.12",
"req_description": "验证用户可以选择临时查看整个屏蔽的密码，或者在没有内置功能的平台上临时查看密码的最后输入的字符。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "521",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.2",
"section_name": "通用身份验证器的安全性",
"req_id": "V2.2.1",
"req_description": "验证反自动化控制的措施能够有效地缓解被泄露的凭证测试、暴力破解和账户锁定攻击。 这些控制措施包括阻止最常见的泄露密码、软锁定、速率限制、验证码、每次尝试后逐渐增加的间隔时间、IP地址限制，或基于风险的限制，例如位置、设备上的首次登录、最近解锁账户的尝试等类似情况。 验证单个帐户每小时的失败尝试次数不超过 100 次。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "307",
"nist": "5.2.2 / 5.1.1.2 / 5.1.4.2 / 5.1.5.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.2",
"section_name": "通用身份验证器的安全性",
"req_id": "V2.2.2",
"req_description": "验证弱身份验证器（例如 SMS 和电子邮件）的使用，仅限于二次验证和批准交易，而不是作为更安全的认证方法的替代。 验证是否在弱方法之前提供了更强的方法，用户是否意识到风险，或者是否采取了适当的措施来限制帐户泄露的风险。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "304",
"nist": "5.2.10"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.2",
"section_name": "通用身份验证器的安全性",
"req_id": "V2.2.3",
"req_description": "验证在更新认证信息（如凭证重置、电子邮件或地址变更、从未知或风险地点登录）后向用户发送安全通知。 最好使用推送通知——而不是短信或电子邮件，但在没有推送通知的情况下，只要通知中没有披露敏感信息，短信或电子邮件也是可以接受的。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "620",
"nist": ""
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.2",
"section_name": "通用身份验证器的安全性",
"req_id": "V2.2.4",
"req_description": "验证对网络钓鱼的抗冒充性，如使用多因素认证、有意图的加密设备（如有推送认证的连接密钥），或在更高的AAL级别，客户端证书。",
"level1": "",
"level2": "",
"level3": "✓",
"cwe": "308",
"nist": "5.2.5"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.2",
"section_name": "通用身份验证器的安全性",
"req_id": "V2.2.5",
"req_description": "验证当凭证服务提供者（CSP）和验证认证的应用程序分开时，两个端点之间有相互认证的TLS（mTLS）。",
"level1": "",
"level2": "",
"level3": "✓",
"cwe": "319",
"nist": "5.2.6"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.2",
"section_name": "通用身份验证器的安全性",
"req_id": "V2.2.6",
"req_description": "验证抗重放性，是否通过强制使用一次性密码（OTP）设备、加密认证器或查询代码。",
"level1": "",
"level2": "",
"level3": "✓",
"cwe": "308",
"nist": "5.2.8"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.2",
"section_name": "通用身份验证器的安全性",
"req_id": "V2.2.7",
"req_description": "通过要求输入OTP令牌或用户发起的动作（如按下FIDO硬件钥匙的按钮）来验证认证意图。",
"level1": "",
"level2": "",
"level3": "✓",
"cwe": "308",
"nist": "5.2.9"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.3",
"section_name": "身份验证器生命周期",
"req_id": "V2.3.1",
"req_description": "验证系统生成的初始密码或激活码应该是安全随机生成的，应该至少有6个字符的长度，可以包含字母和数字，并在短时间内过期。这些初始秘密不得被允许成为长期密码。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "330",
"nist": "5.1.1.2 / A.3"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.3",
"section_name": "身份验证器生命周期",
"req_id": "V2.3.2",
"req_description": "验证是否支持注册和使用用户提供的认证设备，如U2F或FIDO令牌。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "308",
"nist": "6.1.3"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.3",
"section_name": "身份验证器生命周期",
"req_id": "V2.3.3",
"req_description": "验证更新指令的发送时间是否足够，以更新有时间限制的认证器。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "287",
"nist": "6.1.4"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.4",
"section_name": "凭证存储",
"req_id": "V2.4.1",
"req_description": "验证密码是以一种可以抵抗离线攻击的形式存储的。密码应使用认可的单向密钥推导或密码散列函数进行加盐和散列。密钥推导和密码散列函数，在生成密码散列时，将密码、盐和计算成本作为输入。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "916",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.4",
"section_name": "凭证存储",
"req_id": "V2.4.2",
"req_description": "验证盐的长度至少为32位，并且是任意选择的，以减少存储的哈希值之间的碰撞。对于每个凭证，应存储唯一的盐值和由此产生的哈希值。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "916",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.4",
"section_name": "凭证存储",
"req_id": "V2.4.3",
"req_description": "验证如果使用 PBKDF2，迭代次数应在验证服务器性能允许的范围内，一般至少为100,000次迭代。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "916",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.4",
"section_name": "凭证存储",
"req_id": "V2.4.4",
"req_description": "验证如果使用 bcrypt，工作系数应在验证服务器性能允许的范围内尽量大，最小为10。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "916",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.4",
"section_name": "凭证存储",
"req_id": "V2.4.5",
"req_description": "验证是否执行了密钥派生函数的额外迭代，使用的是只有验证者知道的秘密盐值。使用经批准的随机位生成器 [SP 800-90Ar1] 生成盐值，并至少提供 SP 800-131A 最新修订版中规定的最低安全强度。秘密盐值应与散列密码分开存储（例如，在像硬件安全模块这样的专用设备中）。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "916",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.5",
"section_name": "凭证恢复",
"req_id": "V2.5.1",
"req_description": "验证系统生成的初始激活或恢复密码，不会以明文形式发送给用户。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "640",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.5",
"section_name": "凭证恢复",
"req_id": "V2.5.2",
"req_description": "验证密码提示或基于知识的身份验证（所谓的“密码保护问题”）不存在。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "640",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.5",
"section_name": "凭证恢复",
"req_id": "V2.5.3",
"req_description": "验证密码凭据恢复不会以任何方式泄露当前密码。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "640",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.5",
"section_name": "凭证恢复",
"req_id": "V2.5.4",
"req_description": "验证共享或默认帐户不存在（例如“root”、“admin”或“sa”）.",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "16",
"nist": "5.1.1.2 / A.3"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.5",
"section_name": "凭证恢复",
"req_id": "V2.5.5",
"req_description": "验证如果更改或替换了身份验证因素，则用户会收到此事件的通知。",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "304",
"nist": "6.1.2.3"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.5",
"section_name": "凭证恢复",
"req_id": "V2.5.6",
"req_description": "验证忘记密码以及其他恢复路径，使用了安全的恢复机制，例如基于时间的OTP（TOTP）或其他软令牌、移动推送或其他离线恢复机制。 ([C6](https://owasp.org/www-project-proactive-controls/#div-numbering))",
"level1": "✓",
"level2": "✓",
"level3": "✓",
"cwe": "640",
"nist": "5.1.1.2"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.5",
"section_name": "凭证恢复",
"req_id": "V2.5.7",
"req_description": "验证如果OTP或多因素身份验证因素丢失，身份证明的执行水平与注册时相同。",
"level1": "",
"level2": "✓",
"level3": "✓",
"cwe": "308",
"nist": "6.1.2.3"
},
{
"chapter_id": "V2",
"chapter_name": "认证",
"section_id": "V2.6",
"section_name": "查找密码认证",
"req_id": "V2.6.1",
"req_description": "验证查找密文只能使用一次。",
"level1": "",
"level2": "✓",
"level3": "✓",