Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
DotSecutiry - Counter Spells and the Art of Kee...
Search
ingrid epure
April 21, 2017
Programming
0
730
DotSecutiry - Counter Spells and the Art of Keeping your Application Safe
dotSecurity Paris 2017
ingrid epure
April 21, 2017
Tweet
Share
More Decks by ingrid epure
See All by ingrid epure
Counter spells and the art of keeping you application safe
ingride
0
610
Making good testing decisions
ingride
0
130
Other Decks in Programming
See All in Programming
PHPでWebSocketサーバーを実装しよう2025
kubotak
0
230
NPOでのDevinの活用
codeforeveryone
0
450
地方に住むエンジニアの残酷な現実とキャリア論
ichimichi
5
1.4k
DroidKnights 2025 - 다양한 스크롤 뷰에서의 영상 재생
gaeun5744
3
330
Kotlin エンジニアへ送る:Swift 案件に参加させられる日に備えて~似てるけど色々違う Swift の仕様 / from Kotlin to Swift
lovee
1
260
WebViewの現在地 - SwiftUI時代のWebKit - / The Current State Of WebView
marcy731
0
100
Result型で“失敗”を型にするPHPコードの書き方
kajitack
4
530
ASP.NETアプリケーションのモダナイズ インフラ編
tomokusaba
1
420
なぜ「共通化」を考え、失敗を繰り返すのか
rinchoku
1
600
既存デザインを変更せずにタップ領域を広げる方法
tahia910
1
240
GraphRAGの仕組みまるわかり
tosuri13
8
500
Deep Dive into ~/.claude/projects
hiragram
10
1.9k
Featured
See All Featured
Into the Great Unknown - MozCon
thekraken
39
1.9k
Scaling GitHub
holman
459
140k
Being A Developer After 40
akosma
90
590k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
Building a Modern Day E-commerce SEO Strategy
aleyda
42
7.4k
For a Future-Friendly Web
brad_frost
179
9.8k
Designing for humans not robots
tammielis
253
25k
Rebuilding a faster, lazier Slack
samanthasiow
82
9.1k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
44
2.4k
Building Better People: How to give real-time feedback that sticks.
wjessup
367
19k
Statistics for Hackers
jakevdp
799
220k
The Language of Interfaces
destraynor
158
25k
Transcript
counter-spells KEEPING YOUR APPLICATION SAFE and the art of
IN WHICH I REALLY WISH I DON’T DIE
None
story time
55 authors 665 commits to master 750 commits to all
branches March 20, 2017 – April 20, 2017 1,967 file changes 29,064 additions / 21,314 deletions shipping to prod > 100times a day
real-time editor that allows HTML input data sanitization is required
⚡
None
[ browsers are wonderful and weird ] ( really really
weird )
[ .href can sometimes be undefined even if present ]
None
None
[ know your enemy. ] ( and that might not
always be just users )
prepare for battle [ prepare your spells. ]
[ code that deals with weirdness better ] [ detect
& alert on weirdness ]
HTML templates JavaScript controllers components
Html Escaping Hypertextescaptus (hyper-text-ESC-aptus ) web framework’s rendering layer escape
HTML H Use for protection against XSS
.js .hbs .html
https://gist.github.com/ingride
[ avoid having to decide if html is safe ]
dangerouslySetInnerHTML - React htmlSafe in Ember trustAsHtml - Angular
Good Components BonumPars (bonum-pars) GC make component arguments not be
de-facto public API smaller components
just a simple title a styled message
] - title component ] - body component super-card-component
each component decides on implementation while invocation remains the same
composition instead of inheritance better encapsulation and clarity
https://embermap.com/topics/contextual- components/flexible-interfaces https://facebook.github.io/react/docs/composition-vs- inheritance.html
Good Helpers BonumAuxilium (bonum-auxilium) GH prefer updating the DOM over
returning HTML
create a text node set attributes append the anchor child
element return the the node use the DOM to create an element
Avoid Triple Curlies TripliciCrispusExpellus (Tri-pli-ci-crispus ) using on direct user
input can introduce vulnerabilities {{{ {{{ = htmlSafe() for templates
good helpers + good components = ♥
Thou Shall Noopen NoopenerNoreferrerExpellus (apertus-tour-expellus) N always use noopener AND
noreferrer with target=‘_blank’
newly opened tab can change the window.opener.location to a phishing
page window.opener.location is fair game Firefox uses noreferrer-only until v.52 partial access to the linking page via window.opener
static analysers regexp are evil watermarks are ♥ Detect &
Alert esLint & template linters
use the abstract syntax tree ( AST ) for Mustache:
MustacheStatement target= ‘_blank’ / elements : ElementNode & node attributes plug it in with your cli
https://github.com/rwjblue/ember-template-lint
story time
[ before esLint there was… grep]
postBuild hook to get real-time feedback find + grep +
regexp + wc to get the count compare the count against a static limit fail the build if numbers don’t match
[ regexp are like black magic. They're powerful & get
the job done, but you also fear them and might have to sell your soul in the process ] [ regexp rage by ingride ]
EsLint BonumLintum (bonum-LINT-um) EL Introduce a line in the sand
for blacklisted methods Use linters for real-time feedback in dev
esLint plugin with a custom rule that checks for blacklisted
methods
None
esLint CLI + custom rule to get the count fail
the build if errorCount > max allowed enable esLint cache for increased performance integration with ember-cli
None
from ♥ with [ blacklist methods addon coming soon ]
Content Security Policy SecuritasContentus (SECUR-itas-kontent-us ) mitigates XSS & data-injection
attacks CSP use to whitelist "safe" script hosts use v2 and v3 only use with hash-source & nonce-source
CSP Clean code Tools block deal with weirdness alert on
weirdness
[ thank you. ] @ingridepure @ingride