Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

added some reminders in handling inputs and file uploads #61

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

added some reminders in handling inputs and file uploads #61

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion security-checklist.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
- [ ] Serially iterable resource id should be avoided. Use `/me/orders` instead of `/user/37153/orders`. This acts as a sanity check in case you forgot to check for authorization token.
- [ ] `Edit email/phone number` feature should be accompanied by a verification email to the owner of the account.
- [ ] Any upload feature should sanitize the filename provided by the user. Also, for generally reasons apart from security, upload to something like S3 (and post-process using lambda) and not your own server capable of executing code.
- [ ] `Profile photo upload` feature should sanitize all the `EXIF` tags also if not required.
- [ ] `Profile photo upload` feature should sanitize all the `EXIF` tags also if not required. You can also recreate the image and destroy the uploaded one and store the recreated image see [DVWA Image Upload](https://github.com/ethicalhack3r/DVWA/blob/master/vulnerabilities/upload/source/impossible.php).
- [ ] For user ids and other ids, use [RFC compliant ](http://www.ietf.org/rfc/rfc4122.txt) `UUID` instead of integers. You can find an implementation for this for your language on Github.
- [ ] JWT are awesome. Use them if required for your single page app/APIs.

Expand Down Expand Up @@ -54,6 +54,7 @@
##### SANITIZATION OF INPUT
- [ ] `Sanitize` all user inputs or any input parameters exposed to user to prevent [XSS](https://en.wikipedia.org/wiki/Cross-site_scripting).
- [ ] Always use parameterized queries to prevent [SQL Injection](https://en.wikipedia.org/wiki/SQL_injection).
- [ ] For noSQL databases (eg: MongoDB) Do not pass in the whole request body to instantiate an instance of your model. Extract the only the fields that the model needs. If not, request body can be easily tampered using burp suite. Assuming your model has an IsAdmin property, it will be set as true though not part of the signup form when the request is intercepted by a proxy server
- [ ] Sanitize user input if using it directly for functionalities like CSV import.
- [ ] `Sanitize` user input for special cases like robots.txt as profile names in case you are using a url pattern like coolcorp.io/username.
- [ ] Do not hand code or build JSON by string concatenation ever, no matter how small the object is. Use your language defined libraries or framework.
Expand Down