Skip to content

Commit 8941ded

Browse files
committed
style(A9:2023RC): max line length
1 parent 803cfbe commit 8941ded

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

2023/en/src/0xa9-improper-assets-management.md

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ the APIs are storing or sharing data with external third parties.
1616
Running multiple versions of an API requires additional management resources
1717
from the API provider and expands the attack surface.
1818

19-
An API has a "<ins>documentation blindspot</ins> if:
19+
An API has a "<ins>documentation blindspot</ins>" if:
2020

2121
* The purpose of an API host is unclear, and there are no explicit answers to
2222
the following questions
@@ -48,10 +48,10 @@ An API has a "<ins>data flow blindspot</ins>" if:
4848
A social network implemented a rate-limiting mechanism that blocks attackers
4949
from using brute force to guess reset password tokens. This mechanism wasn't
5050
implemented as part of the API code itself but in a separate component between
51-
the client and the official API (```api.socialnetwork.owasp.org```). A researcher found a
52-
beta API host (```beta.api.socialnetwork.owasp.org```) that runs the same API,
53-
including the reset password mechanism, but the rate-limiting mechanism was not
54-
in place. The researcher was able to reset the password of any user by using
51+
the client and the official API (`api.socialnetwork.owasp.org`). A researcher
52+
found a beta API host (`beta.api.socialnetwork.owasp.org`) that runs the same
53+
API, including the reset password mechanism, but the rate-limiting mechanism was
54+
not in place. The researcher was able to reset the password of any user by using
5555
simple brute force to guess the 6 digit token.
5656

5757
### Scenario #2
@@ -104,3 +104,4 @@ sells the information for malicious purposes.
104104
* [CWE-1059: Incomplete Documentation][1]
105105

106106
[1]: https://cwe.mitre.org/data/definitions/1059.html
107+

0 commit comments

Comments
 (0)