Questions tagged [code-security]
Code Security is the process of protecting against theft and unauthorized distribution.
If a code inspection tool finds a "heap inspection" vulnerability, is that relevant if the code is for a web app running on a private server?
Recently, at the organization I work for, we've been using a static code inspection tool. One of the more interesting findings is that private information, such as passwords, may be stored in the heap ...
How can Data security be ensured in an open source software?
In open source projects handling user data in a secure manner can be managed, for example through encryption and password protected functionality. What I'd like to create is a way for the user to ...
Since `strcpy`, `strcat`, and `sprintf` are dangerous, what shall we use in stead of them?
In Computer Systems: a Programmer's Perspective, Unfortunately, a number of commonly used library functions, including strcpy, strcat, and sprintf, have the property that they can generate a byte ...
How secure LocalStorage on a SPA
I'm developing an Ionic 4 based (Angular) web application. It has a lot of logic on it and needs to store session specific data (such as a JWT, selected language, among other preferences and temporary ...
Is it possible to prevent tech scammers from editing bank webpages?
In a refund tech scam, tech scammers use Chrome Developer Tools to edit the HTML directly on the victim's bank webpage through a Remote Desktop (Teamviewer, AnyDesk, etc) to fool their victim into ...
How can we avoid showing the literal path in the exception's stack trace?
When our in-house developed application (C#, ASP.NET) is throwing an exception, it displays a stack trace that contains path information like C:\users\DEVELOPER_FULL_NAME\path\some-module.cs. So it ...
How to protect software from being deleted by antivirus? [duplicate]
I work for a publishing company and we are making interactive software that accompanies our books. The problem is that many clients complain that the antivirus keeps deleting parts of the software, ...
Protect Part of the Code
My company works with different developers from different studios, always sharing the code to everyone aboard. At the moment, we need to protect a part of the code, not from theft but from some ...
Keeping secrets out of source control - are we just moving the problem?
I inherited some projects in which secrets were in source control in App.config and similar files. Fortunately it's not a public repository so the risk isn't as serious as it could have been. I'm ...
Web Security (PHP) - Is it Secure to do downloading files & presenting with Headers to the End User ?
I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ? We have customers invoice files stored in a server location (...
Locking access to a Class Library (C#)
I have been tasked with designing a class library that I am loathe to actually build. It is basically a huge backdoor to our software security. The idea was that it would only be accessible from one ...
How do you ensure external dependencies aren't a security risk?
We use quite a few external open source libraries in our projects, pulled in from Maven Central etc. I was wondering what is best practice to ensuring that you don't introduce some sort of security ...
Converting Java code run by dependency to native code
Is it, at least theoretically, possible to convert a Java application into native code that can be run by something else written in Java? One example of this could be a Minecraft Spigot server. You ...
What security practices do I employ when building a library that requires low level root access to certain devices and files?
Backstory I am writing a library that accesses the kernel module, uinput which allows you to create or take control of devices in /dev/input/event#, and insert events into them. A simple usecase would ...
securing database username and password in a web framework
In most web application which deals with a database, one has to enter the DB creds in a settings or config file, like DATABASES variable in settings.py in Django. What is the general practice to ...
How to make associations security proof
When designing an application I usually stumble upon a problem I've never quite managed to handle properly. Suppose you have Products and Orders. Usually in my data-access layer I have repositories ...
Should security code review involve stylistic culprits?
I have worked in company A for less than 1 year and I was given the task to do a security code review for a small project I was involved in the late 3 months. Until now I have been mainly been reading ...
Is opening a templating engine to users a bad idea?
My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site. However, I'm not sure if it'...
How to protect source code from being copied or leaked by employes [duplicate]
I'm a Java Developer, I created a Desktop Application , that is Free, and now I'm about to finish the payed version. my question is when I create a startup and other developers work on my code. How ...
Is it safe to only use intval to sanitize user input for a database select?
Is it safe to only use intval to sanitize the user input for a database select, as in the following example? $id = intval($_GET['id']); $query = "SELECT * FROM table WHERE id='$id'";
How can I make an object/class inaccessible to Reflection
I am building an API for minecraft called the Quantum API. We all know that reflection can be used to do some nasty stuff to classes, and even cause undefined behavior if used without care. Is there ...
Is there any point in preventing developers from having a local copy of the database in their machine?
Is there any point to having a dedicated development database server(s) that all developers can use, i.e. they don't have a local copy of the db in their machines. Quite clearly, this will slow down ...
What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed
Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
Enforcing manual inclusion of a specific header file (banned.h)
Banned.h is a list of ANSI C functions that Microsoft is trying to persuade programmers to deprecate. I already know how to enforce automatic inclusion of banned.h (such as the answer to Ensuring that ...
How do you make sure a .net client application is not being hacked to bypass authorization claims?
We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
How to verify that library assemblies originate from a given Web site?
How would the following solution be implemented? Would you need to put this code in each library assembly or just in the main assembly that is determining whether it is safe to call the library ...
Is parsing a submitted JSON object safe?
I have a RESTful API, built in NODE.js that does what you would expect it to: consumes data and then makes it accessible. Currently, data being submitted to my server is nested form data: data[...
Is the flyweight pattern a good security choice for managing permissions?
I'm designing a system, and it needs future expandability for the use of a permission system of some kind. I'm wondering if the flyweight pattern would be a good choice to implement this. I'm not ...
Why does the US government disallow dynamic languages for secure projects?
I know some people that are currently working on a project for the US military (low security level, non-combat human resources type data). An initial state of the project code was submitted to the ...
How safe & trustworthy are hosting sites such as sourceforge, github or bitbucket for closed-source projects? [closed]
I am considering using sourceforge, bitbucket or github for managing source control for my business. I have open projects and I participate in open projects such as gcc. But I also have a business ...
Is there a way to check if redistributed code has been altered?
I would like to redistribute my app (PHP) in a way that the user gets the front end (presentation) layer which is using the API on my server through a web service. I want the user to be able to alter ...
CSRF Protection with codeigniter
I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to ...
Security Concerns with password storage in Scripting Languages (VBA)
The team I work with handles large amounts of consumer survey, and internal company metric data. Primarily the data is stored in a database, and we utilize various platforms and to work with that data,...
Are there any free tools to measure web project's performance, security and other standards?
Are there any open-source tools to measure the standard of a web application project? I want to verify my project for: Possible security leaks (SQL Injection etc.) Performance Stability (in high ...
What should I do when I find sensitive information in version control?
Today I found what looked to be my supervisor's password in some code in version control. The password is to a database. He is very experienced and has explained before how to avoid having passwords ...
How can I prevent a client from seeing my code written in an interpreted language?
I'm building a fairly complex interpreted program in Python. I've been working on most of this code for other purposes for a few months, and therefore don't want my client to be able to simply copy ...