change and move 5.1.6 to 10.4

5.0/en/0x13-V5-Validation-Sanitization-Encoding.md

@@ -38,7 +38,6 @@ Input validation provides valuable hygiene for the application in making sure th
 | **5.1.3** | [MOVED TO 11.3.1] | | |
 | **5.1.4** | [SPLIT TO 11.3.2, 11.3.3] | | |
 | **5.1.5** | [MODIFIED, SPLIT TO 50.8.1] Verify that the application will only automatically redirect the user to a different URL directly from an application URL where the destination appears on an allowlist. | 1 | 601 |
-| **5.1.6** | [ADDED] Verify that the application validates that user-controlled input in HTTP request header fields does not exceed the server's maximum header field size limit (usually 4kB or 8kB) to prevent client-based denial of service attacks. | 2 | |
 
 ## V5.2 Sanitization and Sandboxing
 

5.0/en/0x18-V10-Coding.md

@@ -65,6 +65,7 @@ Complying with this section is likely to be operational and continuous.
 | **10.4.6** | [ADDED] Verify that the application is able to discern and utilizes the user's true IP address to provide for sensitive functions, including rate limiting and logging. | 2 | 348 |
 | **10.4.7** | [MODIFIED, MOVED FROM 5.1.1, LEVEL L1 > L2] Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields). | 2 | 235 |
 | **10.4.8** | [ADDED] Verify that where the application back-end makes calls to external URLs, it is configured to not follow redirects unless it is intended functionality. | 2 | |
+| **10.4.9** | [ADDED] Verify that, if the application (back-end or front-end) builds and sends requests, it uses validation, sanitization, or other mechanisms to avoid creating URIs (such as for API calls) or HTTP request header fields (such as Authorization or Cookie), which are too long to be accepted by the receiving component. This could cause a denial of service, such as when sending an overly long request (e.g. a long cookie header field) results in the server always responding with an error status. | 2 | |
 
 ## V10.5 Security Architecture