Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [secure-coding]

The tag has no usage guidance.

6
votes
1answer
185 views

Username Enumeration in 2018 - How serious is this

I am looking at an application redesign and one of our business team research says that we are not getting or losing customers because they are not able to login. While I don't really care about the ...
2
votes
1answer
69 views

InfoSec consultancy - infrastructure vs development

I work for a company that has done in house application development (for our internal systems) since its inception decades ago. Recently, however, the rise of APIs and real-time data transfer has ...
24
votes
4answers
7k views

Can I trust public code versioning platforms when building a social platform?

We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions. We are currently limited on resources, both ...
0
votes
1answer
63 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
0
votes
1answer
128 views

Key Encryption / Obfuscation

I got a GUI Program, which loads the Logic from a webserver if the entered License Key is valid. The actual connection string I hexed and xor'd with a secret key. (which is unfortunately static) The ...
1
vote
0answers
26 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
0
votes
1answer
26 views

security of swoopnow integration on website [closed]

We are planning to use swoopnow site apis (no-password) integration for our website. (swoopnow provide apis which give user to login on site without any password) However we are not sure about its ...
0
votes
1answer
150 views

Secure file encryption with OpenSSL and a little trick?

I try to really securely encrypt a file with OpenSSL. I´m new to OpenSSL and just read here, that it´s not very secure due to it´s behavior in generating salt & IV, and storing it within the ...
1
vote
2answers
378 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
1
vote
2answers
139 views

How to explain to our developer manager the benefits of using a linter also as a security feature?

Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer. ESlint has a rule to indicate, for example, to use {} which would have ...
3
votes
2answers
95 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
1
vote
0answers
82 views

Veracode still reports OS command injection issue after I have applied the solution as recommendations from OWAPS and Roslyn Security Guard [closed]

Current code in my project is shown below and Veracode reports there is an OS command injection filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg" ProcessStartInfo startInfo = ...
15
votes
5answers
8k views

How many rounds of hashing is enough for a password manager?

I'm currently writing my own little password manager that stores the key in a SHA256 hash, with salt. I create the hash by doing the following: def sha256_rounds(raw, rounds=100001): obj = ...
0
votes
1answer
556 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
2
votes
0answers
118 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...
-1
votes
1answer
63 views

Secure PHP coding without frameworks

I am very new to PHP and some people said that writing PHP code without a framework is insecure. I am not sure about that! Is it possible to write highly secure code without any frameworks? If so, ...
4
votes
3answers
896 views

Should I return meaningful error code in case of internal error?

Let's say I'm using several crypto functions from a 3rd party lib and those crypto functions should never fail because my code, and not a user, is sending all the arguments (buffers, sizes, etc..) so ...
0
votes
1answer
374 views

best way to encrypt code and data on IOT device?

I have R scripts which are running on a Raspberry Pi device. I want to encrypt the code and data on the device so that if anyone unmounts the disk and try to read the content via other devices they ...
1
vote
1answer
600 views

Penetration Testing vs Secure Source Code Review [duplicate]

Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing ...
2
votes
1answer
2k views

Common JavaScript Vulnerabilities

Can someone recommend a secure coding guideline for JavaScript? Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
1
vote
1answer
119 views

A secure connection with an application and a dedicated server

I'm wondering if this kind of technology is already exist (not VPN), I'm looking for a method to make secure internet connection within a dedicated server, where my laptop has a desktop application to ...
1
vote
2answers
455 views

How to securely send a password from one app to another app?

See this question/answer first: When calling a process from another process, Is sending stdin password more secure than sending an ENV variable? I am a Java developer that is building an app where ...
0
votes
1answer
83 views

Integer overflow check not detecting some cases

Something very weird happens when I control my code execution to fish out integer overflows. The control program checks the value of the overflow flag using inline assembly. Code: #include <stdio....
7
votes
1answer
851 views

Identifying vulnerabilities in simple program with malloc

My class is without a textbook, or any structured learning material for that matter. I am doing all my learning through googling and while I am picking it up as I am doing it, it is slow going to be ...
4
votes
2answers
2k views

Secure flag for ASPXAUTH Cookie in MVC

We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool. Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's ...
6
votes
2answers
315 views

How long should I wait before choosing a hash function?

How long should I wait before using a newer (hopefully improved) hash function? For instance: Is SHA-3 ready for use because of extra testing that went on during the NIST competition?
1
vote
2answers
146 views

Homebrewing something like SSL

So me and eight other friends have founded a "company" (not official, we just like calling ourselves that) named sDev and we are making a strategy game. We are aged 16-17 and have about 3-5 years of ...
1
vote
1answer
33 views

Secure application data

I have a private client/server application that trying to secure the data transmitted through public network. The encryption/decryption method is private too. Client and server uses DH key exchange ...
11
votes
4answers
3k views

How secure is the use of fingerprints (like Apple's TouchID) for authentication in banking apps? [closed]

We are working on the development of a banking app and for customers. We need to implement TouchID in Apple's iOS and a fingerprint check in Android. Firstly, what are the possible security risks ...
0
votes
0answers
53 views

Data Protection: Autofill w/o account login

I am creating a system which allows users to split a bill for something. For usability, I'm making it so that payees dont need to login. Payments can be entered manually by the Staff, and they have ...
1
vote
1answer
336 views

What are the risks associated with a vulnerable javascript in a client context?

Background: it is not difficult to introduce vulnerabilities in backend/API code when not coding with security in mind. This typically leads to vulnerabilities such as XSS or various injections (or ...
1
vote
1answer
70 views

Question about transparency [duplicate]

I would like to run a web service (based on Node.js) and I'd be happy to be as transparent as possible with my users. Ideally I'd like to give the users the possibility to verify somehow that my ...
2
votes
0answers
32 views

How to secure/ensure a call from Excel AddIn to IIS Backend?

I need to develop an Excel AddIn which should gather a local information and send it to a backend system which is installed on an IIS (https). In general i want to use https but how can i ensure that ...
1
vote
3answers
89 views

Casting return from ClassUtil.newInstance

I started getting into java security and had a question I could not find an answer to. Lets say we have a web application that uses the following code, and that the UserControlledString can be set ...
0
votes
1answer
523 views

Shall i proceed with CEH-LPT-OSCP? Or any other course? [closed]

Well actually i am student and will be completing my school in more 2-3 months. Being really interested and keen towards the cyber security, i have really surfed the net and asked friends and seniors ...
3
votes
1answer
199 views

What should a job description for a developer focused on secure coding practices look like? [closed]

Recently the organisation that I work for has approved a new role to be focused on ensuring technical solutions are following secure development practices at the code development level. While the ...
1
vote
0answers
65 views

Best practices for the development of security solutions [closed]

IT firms developing security solutions (such as antivirus or Auth systems) are required to adopt a more sophisticated level of management and quality control while developing their products. Security ...
0
votes
0answers
940 views

Store a symmetric key in Java Keystore

It would be great if someone can let me know how exactly we can store a symmetric key in a Java Keystore. It is common to use store key pairs in Keystores. But I need to store a symmetric key and ...
-3
votes
1answer
352 views

How to secure batch script with compiler (not compressor) in Windows?

Batch script, a.k.a. bat or cmd, is good - easy to learn, easy to code, easy to use, easy to distrubute. However it lets coders down when they need to achieve something complex in batch script. The ...
0
votes
2answers
2k views

How can I safely store a password in a .class file?

I have some .java files containing some password variables, and these variables have values: String password = "xyz"; Now after run, when I open the .class file, it contains those passwords. How can ...
1
vote
1answer
50 views

What are the potential consequences of evaluating user input with client side JavaScript?

I have a website into which a user enters a line equation (such as y=2x+5) and it displays the equation to them. Currently, to plot the equation I'm simply running eval() on the input string, like ...
1
vote
1answer
813 views

Is html escape enough for mitigating xss in html attribute if value enclosed within double quote

As mentioned in Owasp Output_Encoding_Rules_Summary why do we need to escape all character except for alphanumeric characters[escape all characters with the HTML Entity &#xHH; format, including ...
-4
votes
1answer
201 views

How to securely code in Java? [closed]

I want to write Java Desktop Applet that is secure. I know that user input validation is very important, but other than that, I have no idea what contributes to a secure java code. I tried looking ...
4
votes
0answers
107 views

Taint analysis in a functional language

I recently read a paper titling "All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)" by Dr. EJ Schwartz. In the paper, he ...
-6
votes
3answers
199 views

Is collecting credit card information the only intention of hackers? [closed]

We are doing a PHP project with simple user signup, sign-in, and account page. We are also collecting PayPal, email id, bank account name, and account number to pay money for them. I read a lot of ...
0
votes
1answer
152 views

So where do I start learning about Cyber Sec? [duplicate]

I'm an 11th grader interested in the whole field/world of IS and what not so I decided to look around this site and various others, and I have come to the conclusion that I have no clue where I am to ...
1
vote
2answers
883 views

High security application in Angular - a bad idea?

Well this is not a question of a specific problem I have it's more a general question. Yesterday I had a little argument with a friend of mine wehter or not a "high security application" (e-Banking ...
41
votes
7answers
5k views

What are some important concepts to teach developers about cross-site scripting (XSS)?

I'm helping with a one-hour training for developers (~100 of them) on cross-site scripting. What are some concepts you think are indispensable to get across to them? Right now we have: Difference ...
2
votes
1answer
52 views

How to code for “Establish and maintain control over all of your outputs”

I was looking into this list (top 25 security issues): https://cwe.mitre.org/top25/index.html#Listing That led me to this list: https://cwe.mitre.org/top25/index.html#Mitigations That led me to ...
4
votes
2answers
146 views

Securely storing clear passwords where one-way encryption/hashing is not an option

I'm working on a service which in the end will pull sales reports etc from an App Store account. The main problem with it though is that Apple (so far) doesn't have a public API to make this possible ...