CSWH + CWE

[drwetter]

• Add term CSWH for the exploit (usefult for searching --> couldn't find anything here)
• Add reference to CWE

Contributions should only be made in the proper repo against the latest content. Please don't open PRs here for versioned or stable content, they represent point-in-time state.

Which branch would be that? At github I could only find v4.2

[kingthorin]

Contributions
Any contributions to the guide itself should be made via the guide’s project repo.

🛑 Contributions should only be made in the proper repo against the latest content. Please don’t open PRs here for versioned or stable content, they represent point-in-time state.

---

Also the acronym doesn't appear to match the name/title you've provided.

[drwetter]

Any contributions to the guide itself should be made via the guide’s project repo

Ah, ok. thanks.

Please update the PR template then. It's not transparent, especially if you're coming from the web site which invites you to click on the github link. proper repo needs to be explained.

Also the acronym doesn't appear to match the name/title you've provided.

?

CSWH is in the title and in the content.

[drwetter]

One last thing, this an off topic: The links should be updated to https where possible in this and other repos:

https://github.com/search?q=repo%3AOWASP%2Fwww-project-web-security-testing-guide+http%3A%2F%2F&type=code

Probably that can be automated somehow like when curl hits a 30x and a location header with https, https should be fine.

[kingthorin]

I'll definitely tweak the template. Seems the comment workflow is busted too.

Is it just me or doesn't CWSH make more sense than CSWH?

If it's cross origin websocket hijacking then what's the S in CSWH.... at least the other way it's the S in WebSocket....

Ummm unless it's Cross site Websocket Hijacking???

[kingthorin]

We don't update any of the versioned content, it's as-is at time of tag/release.

I believe everything (or awfully close) in "latest" should be using https. (There may be examples that haven't been updated but actual links should have been.)

[drwetter]

Most used nowadays is CSWH . Cross-Site !

[kingthorin]

Okay, if you’re going to resubmit on the other repo then please use that vs cross origin

[drwetter]

We don't update any of the versioned content, it's as-is at time of tag/release

Up to you, YMMV. But looking at the offending links (you have a lot like attackers/victims etc. which I am not referring to) I feel ashamed.

[drwetter]

PR on the other site comes tomorrow morning CET

[kingthorin]

Hmmm the template is up-to-date.

https://github.com/OWASP/www-project-web-security-testing-guide/blob/master/.github/pull_request_template.md

[kingthorin]

….it doesn’t render as markdown though. I’ll see if I came make it more clear somehow.