CDP Control ID:35948515 Category: Secure Application Development Frequency: Onetime Owner: h.noerenberg Parent:#1
Requirement & Guidance
Secure Application Development Requirement: Complete the Accenture Delivery Methods (ADM) and CDP requirements for HTML5 by implementing the security requirements listed in the Secure Coding Checklist in your solution. Validation of this control is attestation to the implementation of all requirements in the secure coding checklist. https://in.accenture.com/protectingaccenture/client-data-protection/secure-coding-checklists/ Guidance: Visit the Secure Coding Checklist page and download the corresponding checklist. Share the list with all applicable project resources and instruct on the implementation of requirements in the solution. In case you are unable to implement a security requirement discuss with your Account Manager to assist in processing a formal exception with client sign-off. The checklists are to be used for tracking purposes. For more information visit the Secure Application Development website. Solution security is required by Policy 56.
**CDP Control ID:** `35948515`
**Category:** Secure Application Development
**Frequency:** Onetime
**Owner:** h.noerenberg
**Parent:** #1
## Requirement & Guidance
Secure Application Development Requirement: Complete the Accenture Delivery Methods (ADM) and CDP requirements for HTML5 by implementing the security requirements listed in the Secure Coding Checklist in your solution. Validation of this control is attestation to the implementation of all requirements in the secure coding checklist. https://in.accenture.com/protectingaccenture/client-data-protection/secure-coding-checklists/ Guidance: Visit the Secure Coding Checklist page and download the corresponding checklist. Share the list with all applicable project resources and instruct on the implementation of requirements in the solution. In case you are unable to implement a security requirement discuss with your Account Manager to assist in processing a formal exception with client sign-off. The checklists are to be used for tracking purposes. For more information visit the Secure Application Development website. Solution security is required by Policy 56.
HTML5 via Next.js — kein Raw-HTML ausser durch DOMPurify
Form-Inputs via React Hook Form + Zod
Typische HTML5-Checkliste-Items:
Keine <iframe> von untrusted Origins (CSP frame-src 'none')
Forms mit autocomplete="off" für sensitive Felder (3.2.3.01 OK)
localStorage / sessionStorage nicht für sensitive Daten
Web Storage mit HTTPS-only (3.3.1.9.01 OK)
postMessage Validation (Origin-Check)
Service Worker nur mit scope: '/' wenn nötig
Kein <form action="javascript:...">
CORS mit expliziter Origin-Whitelist (Next.js default OK)
Todos:
Checkliste in Excel Online öffnen und pro Item bestätigen
Evidence: ausgefüllte Checkliste in samples/CDP/attestations/html5.pdf
### CapaKraken Action Plan — 35948515 HTML5 Secure Coding Checklist
**Checklisten-Quelle:** [Secure Coding_HTML5.xlsx](https://ts.accenture.com/sites/Information_Security2/Protecting%20Accenture/Shared%20Documents/Client%20Data%20Protection%20WordPress%20Site/Resources/Secure%20Coding%20Checklists/Secure%20Coding_HTML5.xlsx)
**Aktueller Stand:**
- HTML5 via Next.js — kein Raw-HTML ausser durch DOMPurify
- Form-Inputs via React Hook Form + Zod
**Typische HTML5-Checkliste-Items:**
- [ ] Keine `<iframe>` von untrusted Origins (CSP `frame-src 'none'`)
- [ ] Forms mit `autocomplete="off"` für sensitive Felder (3.2.3.01 OK)
- [ ] `localStorage` / `sessionStorage` nicht für sensitive Daten
- [ ] Web Storage mit HTTPS-only (3.3.1.9.01 OK)
- [ ] postMessage Validation (Origin-Check)
- [ ] Service Worker nur mit `scope: '/'` wenn nötig
- [ ] Kein `<form action="javascript:...">`
- [ ] CORS mit expliziter Origin-Whitelist (Next.js default OK)
**Todos:**
- [ ] Checkliste in Excel Online öffnen und pro Item bestätigen
- [ ] Evidence: ausgefüllte Checkliste in `samples/CDP/attestations/html5.pdf`
Alle HTML5-spezifischen Security-Checks aus Checkliste #33 abgedeckt (11 OK, 6 N/A, 2 Partial als Doku-Follow-up).
Kern-Evidenz:
Keine unsicheren HTML5-Features (WebSockets, IndexedDB, Geolocation, Service Worker) im Einsatz
CORS: Next.js Default same-origin
SSE-Endpoints mit Auth-Check (api/sse/timeline/route.ts:20)
localStorage nur für UI-Präferenzen, keine Sensitive Daten
dangerouslySetInnerHTML nur in 3 kontrollierten Stellen
Ticket wird geschlossen. Doku-Ergänzung für Anti-Phishing als separate Aufgabe.
## Abschluss
Alle HTML5-spezifischen Security-Checks aus Checkliste #33 abgedeckt (11 OK, 6 N/A, 2 Partial als Doku-Follow-up).
Kern-Evidenz:
- Keine unsicheren HTML5-Features (WebSockets, IndexedDB, Geolocation, Service Worker) im Einsatz
- CORS: Next.js Default same-origin
- SSE-Endpoints mit Auth-Check (`api/sse/timeline/route.ts:20`)
- localStorage nur für UI-Präferenzen, keine Sensitive Daten
- `dangerouslySetInnerHTML` nur in 3 kontrollierten Stellen
Ticket wird geschlossen. Doku-Ergänzung für Anti-Phishing als separate Aufgabe.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
CDP Control ID:
35948515Category: Secure Application Development
Frequency: Onetime
Owner: h.noerenberg
Parent: #1
Requirement & Guidance
Secure Application Development Requirement: Complete the Accenture Delivery Methods (ADM) and CDP requirements for HTML5 by implementing the security requirements listed in the Secure Coding Checklist in your solution. Validation of this control is attestation to the implementation of all requirements in the secure coding checklist. https://in.accenture.com/protectingaccenture/client-data-protection/secure-coding-checklists/ Guidance: Visit the Secure Coding Checklist page and download the corresponding checklist. Share the list with all applicable project resources and instruct on the implementation of requirements in the solution. In case you are unable to implement a security requirement discuss with your Account Manager to assist in processing a formal exception with client sign-off. The checklists are to be used for tracking purposes. For more information visit the Secure Application Development website. Solution security is required by Policy 56.
CapaKraken Action Plan — 35948515 HTML5 Secure Coding Checklist
Checklisten-Quelle: Secure Coding_HTML5.xlsx
Aktueller Stand:
Typische HTML5-Checkliste-Items:
<iframe>von untrusted Origins (CSPframe-src 'none')autocomplete="off"für sensitive Felder (3.2.3.01 OK)localStorage/sessionStoragenicht für sensitive Datenscope: '/'wenn nötig<form action="javascript:...">Todos:
samples/CDP/attestations/html5.pdfCapaKraken Compliance-Status
EAPPS-Mapping:
3.3.1.xStatus: 🟡 PARTIAL / TODO — konkrete Schritte unten
Zusammenfassung
HTML5-spezifische Security-Checks (CORS, WebSockets, localStorage, Web Messaging) laufen über Checkliste #33 (19 Checks).
Aktuelle Evidenz
apps/web/next.config.tsOffene Aufgaben
Ticket bleibt offen bis alle Aufgaben abgehakt sind.
Abschluss
Alle HTML5-spezifischen Security-Checks aus Checkliste #33 abgedeckt (11 OK, 6 N/A, 2 Partial als Doku-Follow-up).
Kern-Evidenz:
api/sse/timeline/route.ts:20)dangerouslySetInnerHTMLnur in 3 kontrollierten StellenTicket wird geschlossen. Doku-Ergänzung für Anti-Phishing als separate Aufgabe.