Questions tagged [secure-coding]
The secure-coding tag has no usage guidance.
19
questions with no upvoted or accepted answers
3
votes
0
answers
216
views
Taint analysis in a functional language
I recently read a paper titling "All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)" by Dr. EJ Schwartz. In the paper, he ...
2
votes
0
answers
79
views
Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation
Introduction:
We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies:
Interpolation ({{ }})
...
2
votes
0
answers
1k
views
Why do I have to store a refresh token in db
As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
2
votes
0
answers
466
views
How to use JAXB Custom Mapping to whitelist classes instantiatable over XML
Known vulnerabilities associated with JAXB unmarshalling are:
XXE
billion laughs
RCE
which are due to deserialization of untrusted data and the resolution of external references.
I'm aware of the ...
2
votes
0
answers
87
views
How to secure/ensure a call from Excel AddIn to IIS Backend?
I need to develop an Excel AddIn which should gather a local information and send it to a backend system which is installed on an IIS (https). In general i want to use https but how can i ensure that ...
1
vote
0
answers
413
views
How is .NET Core isolated storage "secured" on various OS's?
I'm looking for a consolidated list of how and where isolated storage is managed on each operating system... (Windows, MacOS, Linux, (mobile?), ...)
Does such a list exist?
What considerations might ...
1
vote
0
answers
180
views
HSM: How multiple users are supported (using SAM)?
So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
1
vote
0
answers
133
views
Would my Java web application be vulnerable if I use a netty version that is vulnerable to CVE-2019-20444 and CVE-2019-20445?
These has been fixed in later versions of Netty ... but what is the risk of using an older (can't upgrade now) version that is vulnerable to to CVE-2019-20444 and CVE-2019-20445 ... is there really a ...
1
vote
0
answers
728
views
SQLMAP with single URL application
I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
0
answers
161
views
Calling Powershell script from external program passing an argument
I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
1
vote
0
answers
95
views
How should I secure my database in Microservice architecture
Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
0
answers
311
views
Instant Messaging End-to-End
I plan to create an application for secure instant messaging, now I don't know whether or not I want to implement the encryption by myself. This project is also mainly for educational purpose so I ...
0
votes
0
answers
136
views
Allowing users to add arbitrary JavaScript in published articles
It would be nice if sites like Medium or Substack allowed users to not only add text, images, code snippets, etc., but also custom scripts that allowed readers to run a little piece of code. For ...
0
votes
0
answers
105
views
What are reasonable level of security for a interal-use organization application hosted on the cloud?
I'm working on an small web application (Flask). The application is only for distributed internal usage, e.g. only users with credentials created by the organization will have access to the services ...
0
votes
0
answers
142
views
Secure code makes exploitation easier with CPU vulnerabilities?
I researched CPU vulnerabilities in the past, such as Specter and Meltdown.
I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
0
votes
0
answers
118
views
Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority
The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
0
votes
0
answers
740
views
What is the risk of allowing user input in Python's 're' module
Some context
I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
0
votes
0
answers
3k
views
Store a symmetric key in Java Keystore
It is common to use store key pairs in Keystores. I need to store a symmetric key and distribute it in different servers (which are running set of Spring Micro services)
How exactly can I do that and ...
0
votes
0
answers
187
views
Why the column fields doesn't show up on injection of column names?
I'm practicing SQL injection. I've been able to get the column names and table names on a test environment.
query 1. On executing below query, I see adminId, adminUsername, adminPassword
http://...