Questions tagged [secure-coding]

The tag has no usage guidance.

19 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
216 views

Taint analysis in a functional language

I recently read a paper titling "All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)" by Dr. EJ Schwartz. In the paper, he ...
madipi's user avatar
  • 131
2 votes
0 answers
79 views

Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation

Introduction: We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies: Interpolation ({{ }}) ...
VJSpeter's user avatar
2 votes
0 answers
1k views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
John's user avatar
  • 21
2 votes
0 answers
466 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...
iammyr's user avatar
  • 41
2 votes
0 answers
87 views

How to secure/ensure a call from Excel AddIn to IIS Backend?

I need to develop an Excel AddIn which should gather a local information and send it to a backend system which is installed on an IIS (https). In general i want to use https but how can i ensure that ...
STORM's user avatar
  • 121
1 vote
0 answers
413 views

How is .NET Core isolated storage "secured" on various OS's?

I'm looking for a consolidated list of how and where isolated storage is managed on each operating system... (Windows, MacOS, Linux, (mobile?), ...) Does such a list exist? What considerations might ...
TLDR's user avatar
  • 700
1 vote
0 answers
180 views

HSM: How multiple users are supported (using SAM)?

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
user3488903's user avatar
1 vote
0 answers
133 views

Would my Java web application be vulnerable if I use a netty version that is vulnerable to CVE-2019-20444 and CVE-2019-20445?

These has been fixed in later versions of Netty ... but what is the risk of using an older (can't upgrade now) version that is vulnerable to to CVE-2019-20444 and CVE-2019-20445 ... is there really a ...
user7676946's user avatar
1 vote
0 answers
728 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
EternalSunShine's user avatar
1 vote
0 answers
161 views

Calling Powershell script from external program passing an argument

I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
Geo V's user avatar
  • 11
1 vote
0 answers
95 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
CodeWeed's user avatar
  • 111
1 vote
0 answers
311 views

Instant Messaging End-to-End

I plan to create an application for secure instant messaging, now I don't know whether or not I want to implement the encryption by myself. This project is also mainly for educational purpose so I ...
conFusion's user avatar
0 votes
0 answers
136 views

Allowing users to add arbitrary JavaScript in published articles

It would be nice if sites like Medium or Substack allowed users to not only add text, images, code snippets, etc., but also custom scripts that allowed readers to run a little piece of code. For ...
Cybernetic's user avatar
0 votes
0 answers
105 views

What are reasonable level of security for a interal-use organization application hosted on the cloud?

I'm working on an small web application (Flask). The application is only for distributed internal usage, e.g. only users with credentials created by the organization will have access to the services ...
Francky_V's user avatar
  • 103
0 votes
0 answers
142 views

Secure code makes exploitation easier with CPU vulnerabilities?

I researched CPU vulnerabilities in the past, such as Specter and Meltdown. I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
user5623335's user avatar
0 votes
0 answers
118 views

Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority

The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
user2023370's user avatar
0 votes
0 answers
740 views

What is the risk of allowing user input in Python's 're' module

Some context I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
Paradoxis's user avatar
  • 882
0 votes
0 answers
3k views

Store a symmetric key in Java Keystore

It is common to use store key pairs in Keystores. I need to store a symmetric key and distribute it in different servers (which are running set of Spring Micro services) How exactly can I do that and ...
user3496510's user avatar
  • 1,297
0 votes
0 answers
187 views

Why the column fields doesn't show up on injection of column names?

I'm practicing SQL injection. I've been able to get the column names and table names on a test environment. query 1. On executing below query, I see adminId, adminUsername, adminPassword http://...
harveyD's user avatar
  • 218