Questions tagged [secure-coding]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
75
votes
10answers
16k views

Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?

Is it good secure programming practice to overwrite sensitive data stored in a variable before it is deleted (or goes out of scope)? My thought is that it would prevent a hacker from being able to ...
56
votes
11answers
13k views

Are there “secure” languages? [closed]

Are there any programming languages that are designed to be robust against hacking? In other words, an application can be hacked due to a broken implementation, even though the design is perfect. I'...
55
votes
5answers
4k views

Should security-critical code be reused or rewritten?

Usually, in programming, reusing code is always a better idea than writing your own implementation of an algorithm. If an implementation has been around for a long time and is still used by lots of ...
41
votes
8answers
8k views

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

I'm developing an application over an intranet and is used only by an internal employee. There wouldn't be any external parties involved here and no external communication would be used by the ...
41
votes
7answers
5k views

What are some important concepts to teach developers about cross-site scripting (XSS)?

I'm helping with a one-hour training for developers (~100 of them) on cross-site scripting. What are some concepts you think are indispensable to get across to them? Right now we have: Difference ...
24
votes
4answers
8k views

Can I trust public code versioning platforms when building a social platform?

We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions. We are currently limited on resources, both ...
15
votes
5answers
9k views

How many rounds of hashing is enough for a password manager?

I'm currently writing my own little password manager that stores the key in a SHA256 hash, with salt. I create the hash by doing the following: def sha256_rounds(raw, rounds=100001): obj = ...
11
votes
4answers
3k views

How secure is the use of fingerprints (like Apple's TouchID) for authentication in banking apps? [closed]

We are working on the development of a banking app and for customers. We need to implement TouchID in Apple's iOS and a fingerprint check in Android. Firstly, what are the possible security risks ...
8
votes
2answers
6k views

In C, not using 'void' if a function does not accept any argument is a potential vulnerability

In CERT secure coding standard, there is a recommendation that "Always specify void even if a function accepts no arguments". A possible security vulnerability is proposed in it. /* Compile using ...
8
votes
3answers
980 views

Is initializing variable to NULL or 0 or -1 a bad practice from security standpoint?

I'm trying to learn little bit about armoring application against reverse engineering. In one article I read that initializing variables to NULL or 0 or -1 is as secure (vs RE) as using common ...
7
votes
1answer
237 views

What is preventing us to start using scrypt in production ?

After a lot of reading the expert opinion on password hashing, I understand that scrypt (which is both memory hard and CPU intensive) is a good candidate for password hashing. But I saw the experts ...
7
votes
3answers
2k views

Setting a limit on password recovery attempts

in a setting where one has forgotten their password, I'd like to be able to limit the attempts of entering in email addresses to something like 10. My first thought was to use a cookie. $attempts = ...
7
votes
3answers
4k views

Is it ok for software to store passwords locally in plain-text?

There are already plenty of questions about what to do when websites store plain-text passwords. But this one is a little different. I use a piece of open-source (see below) software for playing ...
7
votes
1answer
1k views

Identifying vulnerabilities in simple program with malloc

My class is without a textbook, or any structured learning material for that matter. I am doing all my learning through googling and while I am picking it up as I am doing it, it is slow going to be ...
6
votes
3answers
2k views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
6
votes
1answer
308 views

Username Enumeration in 2018 - How serious is this

I am looking at an application redesign and one of our business team research says that we are not getting or losing customers because they are not able to login. While I don't really care about the ...
6
votes
2answers
328 views

How long should I wait before choosing a hash function?

How long should I wait before using a newer (hopefully improved) hash function? For instance: Is SHA-3 ready for use because of extra testing that went on during the NIST competition?
5
votes
2answers
4k views

HTML Input of type text for passwords

A site (I won't name it) is using an input of type text for its password field in an HTML form. The onfocus method then changes those characters to dots. Is there a security breach here ? Or is it ...
5
votes
2answers
1k views

Bug bar in the Microsoft SDLC

The Microsoft SDLC model decomposed the requirement phase into different practices, one of which is creating quality gates/ bug bar, where each identified bug should be classified into client or ...
4
votes
3answers
921 views

Should I return meaningful error code in case of internal error?

Let's say I'm using several crypto functions from a 3rd party lib and those crypto functions should never fail because my code, and not a user, is sending all the arguments (buffers, sizes, etc..) so ...
4
votes
2answers
8k views

How secure is CodeIgniter 3.x?

How secure is the CodeIgniter 3.x framework? I have read that people discourage usage of CodeIgniter because it is unsafe. The problem is: These posts are old and is mainly pointed to the 2.x versions ...
4
votes
3answers
820 views

Which Secure Development Lifecycle model to choose? [closed]

We are going to secure our software development life cycle and have been researching for a good model to start with. I have found 3 major models (methodologies?) which are : Cigital SDLC (7 touch ...
4
votes
2answers
150 views

Securely storing clear passwords where one-way encryption/hashing is not an option

I'm working on a service which in the end will pull sales reports etc from an App Store account. The main problem with it though is that Apple (so far) doesn't have a public API to make this possible ...
4
votes
5answers
3k views

Secure software development checklist [closed]

I'm looking for a secure software development checklist. I know that there exists several secure development methodologies (for example Which Secure Development Lifecycle model to choose?), which ...
4
votes
1answer
240 views

What are possible consequences for applications that depends on Safe Mode for security?

PHP finally removed safe_mode feature: Safe Mode Warning This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0. The PHP safe mode is an attempt to solve the ...
4
votes
1answer
533 views

Building a project on ARM Cortex-M, anything I can do to keep IP secure? Dealing with Chinese knockoffs and sick of it

Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still. There are sites ...
4
votes
2answers
134 views

How can Heap Pollution cause a security flaw

I came across this rule in the CERT Secure Coding Standart for Java. Heap Pollution. I understand this can cause the programm throwing an exception at runtime, but i can't understand how this could ...
4
votes
2answers
3k views

Secure flag for ASPXAUTH Cookie in MVC

We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool. Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's ...
4
votes
1answer
724 views

Security research on Operating system security measures, where to start?

I am researching on operating system security, And I don't know where to look for more information on this. I could find the following sources, but I need more guidance. Sources: Microkernel ...
3
votes
6answers
1k views

Can hackers find secret tokens passed to HTTP GET requests?

I have some code like this in index.php: if(isset($_GET['something'])){ //do something } Can hackers find this and request index.php?something, or is this sufficient for security?
3
votes
1answer
1k views

How to write an authentication module for my website?

This will sound naive for sure, and it is. Being a recent college graduate, I have been wondering on how do average websites implement their authentication modules. I have been using a table storing ...
3
votes
2answers
591 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected by ...
3
votes
2answers
150 views

Difference between secure design patterns and a generic coding guidline?

Is there a difference between secure design patterns and a generic coding guideline from which you can derive a technology specific coding guidline? Patterns like "authentication", "secure sessions" ...
3
votes
2answers
285 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
3
votes
2answers
5k views

Common JavaScript Vulnerabilities

Can someone recommend a secure coding guideline for JavaScript? Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are ...
3
votes
1answer
1k views

security clearance for programmers

I am programmer by day and night, I work within security at the moment working on some security products. I have noticed a few non software engineering based roles which require security clearance. I ...
3
votes
1answer
236 views

What should a job description for a developer focused on secure coding practices look like? [closed]

Recently the organisation that I work for has approved a new role to be focused on ensuring technical solutions are following secure development practices at the code development level. While the ...
3
votes
0answers
117 views

Taint analysis in a functional language

I recently read a paper titling "All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)" by Dr. EJ Schwartz. In the paper, he ...
2
votes
3answers
3k views

Top 10 dangerous mistakes in C programming? [closed]

What is the top dangerous mistakes in C programming? for example misusing a strcpy causes a stack-overflow and code injection. I'm looking for at least 10 bad programming pattern in C.
2
votes
1answer
53 views

Code Change That Resulted in Database Fields and Values Exposed

At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system. I've noticed that with one of the recent changes, you can now see ...
2
votes
1answer
1k views

Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?

I am auditing (reverse engineering) an x86 C++ application without source code. Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
2
votes
1answer
169 views

Buffer Overflow in the C program

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. Here is the question. Sorry the original condition ...
2
votes
2answers
1k views

Way to find security bugs in Scala source code open-source way?

I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
2
votes
0answers
89 views

How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]

Let's say you have a Java app which has a query which can unlock/reset passwords for users like: ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK ...
2
votes
1answer
76 views

InfoSec consultancy - infrastructure vs development

I work for a company that has done in house application development (for our internal systems) since its inception decades ago. Recently, however, the rise of APIs and real-time data transfer has ...
2
votes
0answers
252 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...
2
votes
0answers
32 views

How to secure/ensure a call from Excel AddIn to IIS Backend?

I need to develop an Excel AddIn which should gather a local information and send it to a backend system which is installed on an IIS (https). In general i want to use https but how can i ensure that ...
2
votes
0answers
892 views

Best practices to implement a secure CAPTCHA [closed]

What are the best practices to implement a secure CAPTCHA? Also I want to know: What is the best way to identify an insecure CAPTCHA?
2
votes
1answer
62 views

How to code for “Establish and maintain control over all of your outputs”

I was looking into this list (top 25 security issues): https://cwe.mitre.org/top25/index.html#Listing That led me to this list: https://cwe.mitre.org/top25/index.html#Mitigations That led me to ...
1
vote
2answers
159 views

How do we secure image parsing libraries against buffer overflow?

New to buffer overflow through image parsing. How can one design a secure library that parses images, and ensure there are no security vulnerabilities in it? It is common knowledge that image parsing ...