Summary

Interpreted code (e.g., Javascript, CSS) must be loaded from domains controlled by the organization.

Description

Applications often use resources or have dependencies that are hosted on other servers. These resources should be hosted on domains controlled by the organization in order to prevent several types of injection attacks.

References

• CAPEC-19. Embedding scripts within scripts
• CAPEC-154. Resource location spoofing
• CAPEC-175. Code inclusion
• CAPEC-242. Code injection
• CWE-830. Inclusion of web functionality from an untrusted source
• OWASP10-A3. Injection
• OWASP10-A5. Security misconfiguration
• OWASP10-A8. Software and data integrity failures
• OWASPM10-M9. Reverse engineering
• PADSS-5_2_1. Injection flaws, particularly SQL injection
• SANS25-23. Improper Control of Generation of Code ('Code Injection')
• ISO27002-8_26. Application security requirements
• NISTSSDF-PW_6_1. Configure the compilation, interpreter, and build processes to improve executable security
• ASVS-5_2_8. Sanitization and sandboxing
• OWASPAPI-API9. Improper Inventory Management
• CWE25-94. Improper Control of Generation of Code ('Code Injection')
• ISO27001-8_26. Application security requirements