We changed our privacy policy. Read more.

Questions tagged [secure-coding]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
71 views

What are the security considerations for coding a website with interactive scripts but no backend?

I am developing a simple grammar study website with Bootstrap 5, JQuery and Javascript. It will have interactive grammar quizzes and flashcards. I would like users to be able to type in answers to ...
2
votes
1answer
40 views

Sharing account verification tokens to third parties

This is a brief sanity check for myself to confirm whether or not the premise of the title is a good idea or not. Suppose we have an internal system for password reset or account verification. When a ...
0
votes
0answers
88 views

How to handle Antiforgery on Multiple ASP.Net Core APIs and Angular SPA

I am using an Angular SPA which calls multiple Asp.Net Core APIs. I need to enable Antiforgeryvalidation in all APIs and all requests should be validated. 1.) Products API hosted mydomain.com/api/...
0
votes
1answer
94 views

The difficulty of securely storing a password

We have an open source software that allows users to be created. The users are saved in an LDAP directory. The software connects to the LDAP as an administrator to write a new entry for a new user, or ...
0
votes
0answers
52 views

Allowing users to add arbitrary JavaScript in published articles

It would be nice if sites like Medium or Substack allowed users to not only add text, images, code snippets, etc., but also custom scripts that allowed readers to run a little piece of code. For ...
0
votes
0answers
44 views

What are reasonable level of security for a interal-use organization application hosted on the cloud?

I'm working on an small web application (Flask). The application is only for distributed internal usage, e.g. only users with credentials created by the organization will have access to the services ...
1
vote
0answers
94 views

How is .NET Core isolated storage "secured" on various OS's?

I'm looking for a consolidated list of how and where isolated storage is managed on each operating system... (Windows, MacOS, Linux, (mobile?), ...) Does such a list exist? What considerations might ...
0
votes
2answers
49 views

allowing users to add custom html/js code and show it only under another domain

I have a web app where I allow users to create a one-page portfolio using drag and drop, also I allow them to add custom HTML freely (basically any html or js code) I'm aware that I shouldn't allow ...
0
votes
1answer
77 views

Impact of the System Information Leak

Our application stored **e.printstacktrace()** in a log file, which is accessible to a specific user group. We need such detailed information for debugging purposes. As per the security team, they are ...
36
votes
2answers
26k views

Why is there no web client for Signal?

I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure. ...
0
votes
0answers
79 views

Secure code makes exploitation easier with CPU vulnerabilities?

I researched CPU vulnerabilities in the past, such as Specter and Meltdown. I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
0
votes
1answer
74 views

Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]

There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
0
votes
2answers
70 views

How to find vulnerabilities in a program by looking at it's source code [closed]

Hello I have recently started learning Reverse Engineering. I often hear that it's much easier to find vulnerabilities in a program by looking at it's source code, but i don't know how to find them or ...
0
votes
1answer
136 views

Is my code safe enough to be publish on the server side? [duplicate]

I'm new here to ask a question. Sorry if my question had miss explanation. I just wanna ask if my PHP code is secure enough. Please find below is the source code: Get the ID for choosing the Value ...
1
vote
2answers
59 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
0
votes
2answers
99 views

Can demo exploits/attacks be run on desktop applications? [closed]

Are there any applications/tools for exploiting desktop applications? (with pre-built exploits) I'd like to test my Java desktop app for security. I've looked at tools like Metasploit, but they seem ...
1
vote
0answers
63 views

HSM: How multiple users are supported (using SAM)?

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
1
vote
0answers
70 views

Would my Java web application be vulnerable if I use a netty version that is vulnerable to CVE-2019-20444 and CVE-2019-20445?

These has been fixed in later versions of Netty ... but what is the risk of using an older (can't upgrade now) version that is vulnerable to to CVE-2019-20444 and CVE-2019-20445 ... is there really a ...
41
votes
8answers
8k views

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

I'm developing an application over an intranet and is used only by an internal employee. There wouldn't be any external parties involved here and no external communication would be used by the ...
1
vote
0answers
413 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
0
votes
0answers
45 views

Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority

The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
2
votes
1answer
56 views

Code Change That Resulted in Database Fields and Values Exposed

At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system. I've noticed that with one of the recent changes, you can now see ...
0
votes
2answers
1k views

"Reflected XSS"-like attack on chatbot AI

This is a theoretical question. I just watched a certain video in which the author apparently unmasks a chatbot AI that is likely trying to harvest data and spread influence in a cult-like manner on a ...
1
vote
2answers
360 views

How do we secure image parsing libraries against buffer overflow?

New to buffer overflow through image parsing. How can one design a secure library that parses images, and ensure there are no security vulnerabilities in it? It is common knowledge that image parsing ...
2
votes
1answer
412 views

Buffer Overflow in the C program

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. Here is the question. Sorry the original condition ...
0
votes
1answer
241 views

Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for ...
1
vote
0answers
74 views

Calling Powershell script from external program passing an argument

I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
2
votes
0answers
141 views

How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]

Let's say you have a Java app which has a query which can unlock/reset passwords for users like: ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK ...
0
votes
1answer
251 views

Securing exec against executing adversary shell commands

I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user'...
0
votes
1answer
131 views

Securing a website for my school project [closed]

I have been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login ...
0
votes
0answers
469 views

What is the risk of allowing user input in Python's 're' module

Some context I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
0
votes
1answer
337 views

Hiring an AppSec Engineer - What to look for?

I am in the process of trying to hire an AppSec Engineer to review our source code manually and have only been able to find those using appscan tools for secure code reviews. Is there something in ...
1
vote
1answer
395 views

Secure coding standards and guidelines

I was trying to research on available secure coding guidelines of server-side and client-side languages. There are online documentation from Oracle for Java, Microsoft for asp.net, and w3 for html5 ...
0
votes
2answers
261 views

What factors should I consider when choosing the key for encryption and decryption?

We have an application that uses cookies to transmit employee personal data over from the front end to the server. We have planned to use TLS 1.2 for the encryption in transit. However once the java ...
1
vote
1answer
158 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
6
votes
1answer
518 views

Username Enumeration in 2018 - How serious is this

I am looking at an application redesign and one of our business team research says that we are not getting or losing customers because they are not able to login. While I don't really care about the ...
2
votes
1answer
80 views

InfoSec consultancy - infrastructure vs development

I work for a company that has done in house application development (for our internal systems) since its inception decades ago. Recently, however, the rise of APIs and real-time data transfer has ...
24
votes
4answers
8k views

Can I trust public code versioning platforms when building a social platform?

We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions. We are currently limited on resources, both ...
1
vote
1answer
393 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
0
votes
1answer
941 views

Key Encryption / Obfuscation

I got a GUI Program, which loads the Logic from a webserver if the entered License Key is valid. The actual connection string I hexed and xor'd with a secret key. (which is unfortunately static) The ...
1
vote
0answers
35 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
0
votes
1answer
126 views

security of swoopnow integration on website [closed]

We are planning to use swoopnow site apis (no-password) integration for our website. (swoopnow provide apis which give user to login on site without any password) However we are not sure about its ...
0
votes
1answer
622 views

Secure file encryption with OpenSSL and a little trick?

I try to really securely encrypt a file with OpenSSL. I´m new to OpenSSL and just read here, that it´s not very secure due to it´s behavior in generating salt & IV, and storing it within the ...
1
vote
2answers
3k views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
1
vote
2answers
216 views

How to explain to our developer manager the benefits of using a linter also as a security feature?

Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer. ESlint has a rule to indicate, for example, to use {} which would have ...
4
votes
2answers
413 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
1
vote
0answers
247 views

Veracode still reports OS command injection issue after I have applied the solution as recommendations from OWAPS and Roslyn Security Guard [closed]

Current code in my project is shown below and Veracode reports there is an OS command injection filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg" ProcessStartInfo startInfo = ...
16
votes
5answers
10k views

How many rounds of hashing is enough for a password manager?

I'm currently writing my own little password manager that stores the key in a SHA256 hash, with salt. I create the hash by doing the following: def sha256_rounds(raw, rounds=100001): obj = ...
1
vote
1answer
899 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
2
votes
0answers
318 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...