Questions tagged [source-code]
Security relative to source-code edition, protection and management.
238
questions
0
votes
1
answer
66
views
Is there evidence that using SAST / SCA brings positive ROI to software companies?
Using SAST / SCA tools within the delivery pipelines is quite common these days; however, in the software my teams are building, the SAST tools that we're using are very rarely finding even relatively ...
1
vote
1
answer
53
views
Preventing Unauthorized Public Exposure of Repositories
Recently, a developer accidentally made a private repository public, which contained secret keys. Although a third-party application promptly flagged and rotated the exposed credentials, the ...
- 11
1
vote
1
answer
383
views
Decrypt python source code at runtime [closed]
I'm wondering if it's possible to get the source code of some python program if the developer encrypted this source. We download a program in which the source is encrypted. But in order to translate ...
3
votes
1
answer
855
views
How do I prevent user from accessing docker image content?
I have a SaaS web application. One of my clients needs the app to be installed on his infrastructure (meaning physically on servers only they can access). The application stack is 2 docker images: one ...
- 31
50
votes
3
answers
14k
views
Malicious code somehow hidden with whitespace?
I recently came across a php file on a compromised website that had what appeared (in Sublime Text) to be a huge white-space gap. When I run a diff against the original source file I can clearly see ...
- 625
1
vote
1
answer
104
views
Is switching my C/C++ compiler for security testing generally reliable?
If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
- 1,199
2
votes
3
answers
318
views
Is it safe to check-in a RSA private key?
As far as I know, it is bad to check-in something like a password in a version control system. However, I saw in a project that a private_key.pem file with -----BEGIN RSA PRIVATE KEY----- ... content ...
- 121
2
votes
3
answers
337
views
Is Chrome's view-source dangerous when visiting malicious sites? [duplicate]
What are the risks of viewing the source code of malicious pages on Google Chrome?
I want to go directly to view-source:https://example-site.com to visit the sites without rendering anything malicious ...
2
votes
4
answers
817
views
Code obfuscation and source code repositories
As I understand, code obfuscation is used to make reverse engineering difficult/hard for the adversaries/red team.
Now if I use a source code obfuscator where a .C/.CPP file is used as input and an ...
2
votes
1
answer
459
views
Validating web app source code integrity
I am interested if it could be possible to validate source code integrity for web apps somehow.
For example:
Developer builds app and sign source code with his private key. Both signature and public ...
- 21
1
vote
1
answer
123
views
How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?
I am trying to reason about how native apps can avoid the problems web apps have in dealing with the "Browser Cryptography Chicken and Egg" problem, which has been discussed numerous times ...
- 13
1
vote
1
answer
465
views
How is it possible to simply a decode Bluetooth communications from a medical device?
Excuse the naive question but I'm trying to understand a bit about security in home health and medial devices and a recent report about how home Covid test results can be altered has left me a bit ...
- 333
3
votes
1
answer
515
views
Does using view page source on a possibly malicious site carry any real risks?
As far as I know, View page source does not execute any JavaScript, but is that good enough?
Could there in theory be any vulnerabilities in the HTML parser or something similar?
Have there been any ...
- 1,633
0
votes
1
answer
270
views
Bypass encryption by altering source code
In the Cryptsetup Frequently Asked Questions page it says:
You are asked a passphrase of an existing key-slot first, before you can enter the passphrase for the new key-slot. Otherwise you could ...
- 103
0
votes
1
answer
136
views
Building software in group [closed]
If one made software, but later needed others to work on the project, how to secure the software files and source code if one of the developers tried to share the source code with others or if someone ...
1
vote
0
answers
49
views
Is there a way to verify what code has been run? Maybe TEE? [duplicate]
I would like to verify that users are running particular source code. Is there a way this could be achieved?
I want to verify that the original "algorithm" has been followed correctly if you ...
- 11
0
votes
2
answers
182
views
How to Prevent Copying of Device Source Code in Manufacturing
Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
- 1
1
vote
0
answers
23
views
Is it possible to verify the source code of a web service? [duplicate]
Let's say HonestInc is super generous and provides the source code of its web application HonestApp on github. However, I'm extremely distrustful of them, and have doubts that their actual server is ...
- 3,482
2
votes
1
answer
391
views
Does recompiling a binary from source code make it more secure/obscure?
Using standard hardening options like PIC, Stack Protection ...
does a mere recompilation make a program more secure against attacks?
You have the source code of a program, compile it two times with ...
- 21
-1
votes
2
answers
463
views
How can I find if my website code has been implemented somewhere else?
The idea is to find, through some search engine or tool, a HTML tag structure, or HTML fingerprint, which reveals similarly coded pages to a particular one.
A traditional search engine like Google or ...
0
votes
1
answer
151
views
Can a source code be shared and secured form unauthorized use at the same time?
We have developed a script that generates certain reports as output. Input data being confidential in nature, one of our clients wants the code to be hosted in their country and also for the business ...
- 1
0
votes
1
answer
235
views
Impact of the System Information Leak
Our application stored **e.printstacktrace()** in a log file, which is accessible to a specific user group. We need such detailed information for debugging purposes.
As per the security team, they are ...
- 449
2
votes
1
answer
201
views
Should we build a generic security unit test suite
As part of our secure SDLC, we are delivering security as security requirements directly into the backlog of an application team. The security requirements will directly correlate to the functional ...
- 21
1
vote
1
answer
740
views
Safe sharing source code with 3rd party for security review?
I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with ...
- 113
0
votes
1
answer
238
views
How should I protect an algorithm that I want to sell?
I created a trading algorithm which I want to sell. People would be able to buy the "bot" at my website and it would run from there on (if this is even safe to do).
What is the best way to ...
- 113
3
votes
3
answers
377
views
Cryptographically prove open sourced source code of server
I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
- 31
0
votes
1
answer
222
views
How to prevent Source code excessive usage and redistribution?
We sell our code to a company that they can run our code 100 times a month. We need to do a few things before giving the code to the company.
Hide our logic (we can hide our logic by code obfuscation)...
1
vote
2
answers
382
views
Solutions for backing-up my codebase
I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github ...
- 31
3
votes
1
answer
542
views
How to prevent azure pipelines (yaml) from being used as an attack vector?
Let's say the following scenario exists:
A git repository exists on Azure DevOps Repos.
The repository uses yaml pipelines (azure-pipelines.yml).
The repository has branch policies to ensure that ...
- 131
-1
votes
1
answer
647
views
What is the difference between "secure code review" and "secure static code analysis"?
What are the subtle differences in both - as one could say that both are almost the same...
Static Code Analysis (also known as Source Code Analysis) is usually
performed as part of a Code ...
- 11
2
votes
2
answers
182
views
Does removing features from a library increase or reduce security risks?
Software libraries targetting resource constrained environments like embedded systems use conditional compilation to allow consumers to shave space and thus increase performance by removing unused ...
- 113
0
votes
1
answer
111
views
Proving a software deployment's origin sourcecode [duplicate]
Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL?
sourcecode
from commit #10020 at ...
- 267
86
votes
6
answers
20k
views
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me? [duplicate]
I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
- 711
3
votes
2
answers
3k
views
Is there a standard way to check if a requirements.txt has potential security issues? [closed]
Every open code repository has security issues. Attackers can use three ways to sneak malware in:
Abuse typos: Create a package with a similar name, but the package is malware
Malware + useful code: ...
- 3,942
2
votes
1
answer
6k
views
Path Manipulation Vulnerability
Currently I am working in code review process.
I have few doubts regrading Path Manipulation Vulnerability.
Some portion of the Path is already hard coded and with extension
public class ReadFile {
...
- 449
0
votes
1
answer
1k
views
Exploit include_once in PHP Code
For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
- 23
4
votes
3
answers
2k
views
Ken Thompson's compiler hack
I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point?
Can we be sure that there are no ...
- 265
2
votes
1
answer
2k
views
PHP assert code injection
Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php.
$entityId = $_GET["name"];
public function getMetaData($entityId) {
assert('...
- 43
1
vote
0
answers
38
views
Found possible malware code on site - contacted owner - what does it do? [duplicate]
Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited.
The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
- 113
39
votes
5
answers
8k
views
How should source code security be checked?
How to check whether the source code of an open-source project contains no malicious content? For example, in a set of source code files with altogether 30,000 lines, there might be 1-2 lines ...
- 2,257
3
votes
1
answer
798
views
How is compiling a program from source more secure?
When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc.
However, I often see people who say that compiling the code from source is the ...
- 193
1
vote
2
answers
333
views
How to explain to our developer manager the benefits of using a linter also as a security feature?
Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer.
ESlint has a rule to indicate, for example, to use {} which would have ...
- 1,294
5
votes
3
answers
823
views
cases where companies suffered losses due to leaks of source code?
The damage associated with data breaches apparently caused Equifax to
lose $4 billion in value and Facebook to lose about $50 billion, and even if not every dollar of those losses was due to the ...
- 653
0
votes
1
answer
245
views
How curl provided source code that the browser did not?
I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through curl it reveals out HIDDEN directory. How is it even possible? ...
- 493
0
votes
1
answer
407
views
ISO 27001 and copying code from stackoverflow
So ever since we got certified, every time some code from stackoverflow is shown the ISO 27001 argument comes up "we can't copy code".
As a dev, I have to say not allowing code form stackoverflow is ...
- 109
125
votes
8
answers
28k
views
Why is storing passwords in version control a bad idea?
My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?"
I gave him an answer that ...
- 6,584
0
votes
1
answer
639
views
Is hiding my Java desktop app inside a VM the best way to protect my Java source code?
I need to distribute a Java desktop app to the user. I am looking at different ways to protect my source code from reverse engineering.
One method is to distribute a Virtual Machine (says Linux) ...
- 1
0
votes
2
answers
262
views
Restricting source code exposure
Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them.
Also, say you want to keep certain files inaccessible to people ...
- 135
0
votes
4
answers
865
views
Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?
I've heard the eval() function is vulnerable to SQLi.
Can I check for vulnerabilities by simply viewing the website source code?
- 61
1
vote
0
answers
205
views
Single-Page Application authentication and ISO 27001
I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, ...
- 2,153