Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
DotSecutiry - Counter Spells and the Art of Kee...
Search
ingrid epure
April 21, 2017
Programming
0
720
DotSecutiry - Counter Spells and the Art of Keeping your Application Safe
dotSecurity Paris 2017
ingrid epure
April 21, 2017
Tweet
Share
More Decks by ingrid epure
See All by ingrid epure
Counter spells and the art of keeping you application safe
ingride
0
580
Making good testing decisions
ingride
0
120
Other Decks in Programming
See All in Programming
役立つログに取り組もう
irof
28
9.6k
as(型アサーション)を書く前にできること
marokanatani
9
2.6k
Webの技術スタックで マルチプラットフォームアプリ開発を可能にするElixirDesktopの紹介
thehaigo
2
1k
みんなでプロポーザルを書いてみた
yuriko1211
0
260
最新TCAキャッチアップ
0si43
0
140
Remix on Hono on Cloudflare Workers
yusukebe
1
280
Tauriでネイティブアプリを作りたい
tsucchinoko
0
370
Contemporary Test Cases
maaretp
0
130
Amazon Qを使ってIaCを触ろう!
maruto
0
400
ローコードSaaSのUXを向上させるためのTypeScript
taro28
1
610
色々なIaCツールを実際に触って比較してみる
iriikeita
0
330
Nurturing OpenJDK distribution: Eclipse Temurin Success History and plan
ivargrimstad
0
880
Featured
See All Featured
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
169
50k
Site-Speed That Sticks
csswizardry
0
23
The Pragmatic Product Professional
lauravandoore
31
6.3k
Designing Experiences People Love
moore
138
23k
Building a Scalable Design System with Sketch
lauravandoore
459
33k
Fontdeck: Realign not Redesign
paulrobertlloyd
82
5.2k
Building a Modern Day E-commerce SEO Strategy
aleyda
38
6.9k
Designing for Performance
lara
604
68k
It's Worth the Effort
3n
183
27k
Navigating Team Friction
lara
183
14k
Embracing the Ebb and Flow
colly
84
4.5k
Agile that works and the tools we love
rasmusluckow
327
21k
Transcript
counter-spells KEEPING YOUR APPLICATION SAFE and the art of
IN WHICH I REALLY WISH I DON’T DIE
None
story time
55 authors 665 commits to master 750 commits to all
branches March 20, 2017 – April 20, 2017 1,967 file changes 29,064 additions / 21,314 deletions shipping to prod > 100times a day
real-time editor that allows HTML input data sanitization is required
⚡
None
[ browsers are wonderful and weird ] ( really really
weird )
[ .href can sometimes be undefined even if present ]
None
None
[ know your enemy. ] ( and that might not
always be just users )
prepare for battle [ prepare your spells. ]
[ code that deals with weirdness better ] [ detect
& alert on weirdness ]
HTML templates JavaScript controllers components
Html Escaping Hypertextescaptus (hyper-text-ESC-aptus ) web framework’s rendering layer escape
HTML H Use for protection against XSS
.js .hbs .html
https://gist.github.com/ingride
[ avoid having to decide if html is safe ]
dangerouslySetInnerHTML - React htmlSafe in Ember trustAsHtml - Angular
Good Components BonumPars (bonum-pars) GC make component arguments not be
de-facto public API smaller components
just a simple title a styled message
] - title component ] - body component super-card-component
each component decides on implementation while invocation remains the same
composition instead of inheritance better encapsulation and clarity
https://embermap.com/topics/contextual- components/flexible-interfaces https://facebook.github.io/react/docs/composition-vs- inheritance.html
Good Helpers BonumAuxilium (bonum-auxilium) GH prefer updating the DOM over
returning HTML
create a text node set attributes append the anchor child
element return the the node use the DOM to create an element
Avoid Triple Curlies TripliciCrispusExpellus (Tri-pli-ci-crispus ) using on direct user
input can introduce vulnerabilities {{{ {{{ = htmlSafe() for templates
good helpers + good components = ♥
Thou Shall Noopen NoopenerNoreferrerExpellus (apertus-tour-expellus) N always use noopener AND
noreferrer with target=‘_blank’
newly opened tab can change the window.opener.location to a phishing
page window.opener.location is fair game Firefox uses noreferrer-only until v.52 partial access to the linking page via window.opener
static analysers regexp are evil watermarks are ♥ Detect &
Alert esLint & template linters
use the abstract syntax tree ( AST ) for Mustache:
MustacheStatement target= ‘_blank’ / elements : ElementNode & node attributes plug it in with your cli
https://github.com/rwjblue/ember-template-lint
story time
[ before esLint there was… grep]
postBuild hook to get real-time feedback find + grep +
regexp + wc to get the count compare the count against a static limit fail the build if numbers don’t match
[ regexp are like black magic. They're powerful & get
the job done, but you also fear them and might have to sell your soul in the process ] [ regexp rage by ingride ]
EsLint BonumLintum (bonum-LINT-um) EL Introduce a line in the sand
for blacklisted methods Use linters for real-time feedback in dev
esLint plugin with a custom rule that checks for blacklisted
methods
None
esLint CLI + custom rule to get the count fail
the build if errorCount > max allowed enable esLint cache for increased performance integration with ember-cli
None
from ♥ with [ blacklist methods addon coming soon ]
Content Security Policy SecuritasContentus (SECUR-itas-kontent-us ) mitigates XSS & data-injection
attacks CSP use to whitelist "safe" script hosts use v2 and v3 only use with hash-source & nonce-source
CSP Clean code Tools block deal with weirdness alert on
weirdness
[ thank you. ] @ingridepure @ingride