Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
DotSecutiry - Counter Spells and the Art of Kee...
Search
ingrid epure
April 21, 2017
Programming
0
730
DotSecutiry - Counter Spells and the Art of Keeping your Application Safe
dotSecurity Paris 2017
ingrid epure
April 21, 2017
Tweet
Share
More Decks by ingrid epure
See All by ingrid epure
Counter spells and the art of keeping you application safe
ingride
0
620
Making good testing decisions
ingride
0
130
Other Decks in Programming
See All in Programming
The Past, Present, and Future of Enterprise Java with ASF in the Middle
ivargrimstad
0
170
AI Agents: How Do They Work and How to Build Them @ Shift 2025
slobodan
0
100
チームのテスト力を鍛える
goyoki
3
930
複雑なフォームに立ち向かう Next.js の技術選定
macchiitaka
2
240
Updates on MLS on Ruby (and maybe more)
sylph01
1
180
Processing Gem ベースの、2D レトロゲームエンジンの開発
tokujiros
2
130
Ruby Parser progress report 2025
yui_knk
1
460
ProxyによるWindow間RPC機構の構築
syumai
3
1.2k
Reading Rails 1.0 Source Code
okuramasafumi
0
250
Swift Updates - Learn Languages 2025
koher
2
510
Navigating Dependency Injection with Metro
zacsweers
3
3.5k
速いWebフレームワークを作る
yusukebe
5
1.7k
Featured
See All Featured
Designing Dashboards & Data Visualisations in Web Apps
destraynor
231
53k
It's Worth the Effort
3n
187
28k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
12
1.1k
Done Done
chrislema
185
16k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Building a Modern Day E-commerce SEO Strategy
aleyda
43
7.6k
How STYLIGHT went responsive
nonsquared
100
5.8k
How to Think Like a Performance Engineer
csswizardry
26
1.9k
Learning to Love Humans: Emotional Interface Design
aarron
273
40k
GraphQLとの向き合い方2022年版
quramy
49
14k
Fashionably flexible responsive web design (full day workshop)
malarkey
407
66k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
4k
Transcript
counter-spells KEEPING YOUR APPLICATION SAFE and the art of
IN WHICH I REALLY WISH I DON’T DIE
None
story time
55 authors 665 commits to master 750 commits to all
branches March 20, 2017 – April 20, 2017 1,967 file changes 29,064 additions / 21,314 deletions shipping to prod > 100times a day
real-time editor that allows HTML input data sanitization is required
⚡
None
[ browsers are wonderful and weird ] ( really really
weird )
[ .href can sometimes be undefined even if present ]
None
None
[ know your enemy. ] ( and that might not
always be just users )
prepare for battle [ prepare your spells. ]
[ code that deals with weirdness better ] [ detect
& alert on weirdness ]
HTML templates JavaScript controllers components
Html Escaping Hypertextescaptus (hyper-text-ESC-aptus ) web framework’s rendering layer escape
HTML H Use for protection against XSS
.js .hbs .html
https://gist.github.com/ingride
[ avoid having to decide if html is safe ]
dangerouslySetInnerHTML - React htmlSafe in Ember trustAsHtml - Angular
Good Components BonumPars (bonum-pars) GC make component arguments not be
de-facto public API smaller components
just a simple title a styled message
] - title component ] - body component super-card-component
each component decides on implementation while invocation remains the same
composition instead of inheritance better encapsulation and clarity
https://embermap.com/topics/contextual- components/flexible-interfaces https://facebook.github.io/react/docs/composition-vs- inheritance.html
Good Helpers BonumAuxilium (bonum-auxilium) GH prefer updating the DOM over
returning HTML
create a text node set attributes append the anchor child
element return the the node use the DOM to create an element
Avoid Triple Curlies TripliciCrispusExpellus (Tri-pli-ci-crispus ) using on direct user
input can introduce vulnerabilities {{{ {{{ = htmlSafe() for templates
good helpers + good components = ♥
Thou Shall Noopen NoopenerNoreferrerExpellus (apertus-tour-expellus) N always use noopener AND
noreferrer with target=‘_blank’
newly opened tab can change the window.opener.location to a phishing
page window.opener.location is fair game Firefox uses noreferrer-only until v.52 partial access to the linking page via window.opener
static analysers regexp are evil watermarks are ♥ Detect &
Alert esLint & template linters
use the abstract syntax tree ( AST ) for Mustache:
MustacheStatement target= ‘_blank’ / elements : ElementNode & node attributes plug it in with your cli
https://github.com/rwjblue/ember-template-lint
story time
[ before esLint there was… grep]
postBuild hook to get real-time feedback find + grep +
regexp + wc to get the count compare the count against a static limit fail the build if numbers don’t match
[ regexp are like black magic. They're powerful & get
the job done, but you also fear them and might have to sell your soul in the process ] [ regexp rage by ingride ]
EsLint BonumLintum (bonum-LINT-um) EL Introduce a line in the sand
for blacklisted methods Use linters for real-time feedback in dev
esLint plugin with a custom rule that checks for blacklisted
methods
None
esLint CLI + custom rule to get the count fail
the build if errorCount > max allowed enable esLint cache for increased performance integration with ember-cli
None
from ♥ with [ blacklist methods addon coming soon ]
Content Security Policy SecuritasContentus (SECUR-itas-kontent-us ) mitigates XSS & data-injection
attacks CSP use to whitelist "safe" script hosts use v2 and v3 only use with hash-source & nonce-source
CSP Clean code Tools block deal with weirdness alert on
weirdness
[ thank you. ] @ingridepure @ingride