Re:Five Minute Guide to Software Security
by artursapek on Friday October 13, 2017 @05:31PM
(#15469370)
At my last job the HR guy installed this super annoying Slack bot that would spam everyone every week with a "happiness survey". I got so tired of it I eventually logged the requests my survey made and used curl to replay one with a happiness score of -100 (usually the value would be between 0 and 10). Response said "success".
Turned out the backend happily took that value and it skewed our average a lot and the next week I was laughing my ass off while HR was trying to figure out why everyone was suddenly so unhappy.
Re:Five Minute Guide to Software Security
by AlexCoventry on Friday October 13, 2017 @05:33PM
(#15469379)
> Not trusting user input is a good start, but the client shouldn't be trusted, either.
That's in there:
"Validation must occur on the receiving side of communications. Validation on the sending side is a user experience decision."
I would consider "user input" to be everything coming back from the client, that includes everything down to cookies, HTTP-Headers, form values.
Validate everything. Re-check authorisation always.
My favourite too was being new into a development job and buying our biggest package for a penny. What I hadn't counted on was that this was a fairly new system and the CEO was still copied in to every buy order.
Thankfully the company took it in good spirit, I was even sent an expenses form to reclaim the penny! :)
I have seen plenty of web apps that fell short on this...
Whenever I'm on a web app that has a button shown but disabled, you can be pretty sure that I will enable that button and click it...
If the client is limiting the maximum length of the contents of a textbox, I'm probably going to change that and see if the server is performing the same validation...
My favorite so far, though, was client-side calculation and validation of order amounts for some products. Intercepting the JavaScript file and tweaking it before the browser started using it allowed me to place an older for a bunch of products for only $0.01 (going negative was also attempted, too, but this particular system did a pre-approval with a payment gateway and it didn't like that... so I settled on a penny).
These were all things I've done with permission, of course... but it's amazing what you can do when people assume the browser will always follow the rules...