Duplicate 1.12.1 12.4.1 store outside of the web root

[Sjord]

1.12.1 Verify that user-uploaded files are stored outside of the web root.

12.4.1 Verify that files obtained from untrusted sources are stored outside the web root, with limited permissions, preferably with strong validation.

I propose to remove 1.12.1.

[jmanico]

I agree. Can we also clean up 12.4.1 while we are here?

[elarlang]

Agree to remove 1.12.1.

12.4.1 - "preferably with strong validation" does not give anything extra.

And even better question is - how it's different from V4 category requirements? In other words - if someone store their files by folder structure in web root, but you can not access them directly with HTTP request, then what is wrong with that solution (argumentation)?

[jmanico]

I also ask, what is the purpose of 12.4.1? Access control? So attackers cannot access uploaded files? RCE resistance? So attackers cannot upload executable scripts? Both?

[elarlang]

Proposal, as a first step, we can:

• remove 1.2.1 (as it's implementation requirement and duplicate to 12.4.1)
• remove from 12.4.1 "preferably with strong validation." (validation it's covered in general with V5.1 requirements and V12.2.1 should cover it)

Then we can rethink about the point of 12.4.1.

[jmanico]

Good start. I’m happy to take a PR on just that if you like.

[elarlang]

For the record and for discussion:

• 1.2.1 had CWE-522 "CWE-552: Files or Directories Accessible to External Parties"
• 12.4.1 had CWE-922 "CWE-922: Insecure Storage of Sensitive Information"

For me CWE-522 is better option for current requirement, so I set it for 12.4.1:

Verify that files obtained from untrusted sources are stored outside the web root, with limited permissions.

PR #1073

[jmanico]

Current main is now:

| 1.12.1 | [DELETED, DUPLICATE TO 12.4.1] | | | | |
| 12.4.1 | [MODIFIED] Verify that files obtained from untrusted sources are stored outside the web root, with limited permissions. | ✓ | ✓ | ✓ | 552 |

[elarlang]

So, duplicate is removed, but I'm not too happy with this requirement. It feels a bit from old-style PHP crappy architecture, where file in public folder leads to RCE.

The main question is, should we just blindly disallow to store files in public folder in general, or make it a bit more flexible.

• sometimes files are expected to stay in public folder, like "public" images (or we ask them to serve from another domain? is it reasonable?)
• even if .php file is stored in public folder for "PHP application", it's important to avoid to execute it as PHP program code (by web-server configuration for example)

[jmanico]

I totally agree with you. I think 12.4.1 needs to be re-written with better intent.

[elarlang]

duplicate resolved, for finetuning I opened separate issue #1087