Questions tagged [code-security]
Code Security is the process of protecting against theft and unauthorized distribution.
37
questions
4
votes
1
answer
910
views
If a code inspection tool finds a "heap inspection" vulnerability, is that relevant if the code is for a web app running on a private server?
Recently, at the organization I work for, we've been using a static code inspection tool.
One of the more interesting findings is that private information, such as passwords, may be stored in the heap ...
- 2,397
1
vote
4
answers
312
views
How can Data security be ensured in an open source software?
In open source projects handling user data in a secure manner can be managed, for example through encryption and password protected functionality. What I'd like to create is a way for the user to ...
- 129
-4
votes
4
answers
3k
views
Since `strcpy`, `strcat`, and `sprintf` are dangerous, what shall we use in stead of them?
In Computer Systems: a Programmer's Perspective,
Unfortunately,
a number of commonly used library functions, including strcpy, strcat, and
sprintf, have the property that they can generate a byte ...
- 5,365
0
votes
0
answers
51
views
How secure LocalStorage on a SPA
I'm developing an Ionic 4 based (Angular) web application. It has a lot of logic on it and needs to store session specific data (such as a JWT, selected language, among other preferences and temporary ...
- 139
-3
votes
4
answers
1k
views
Is it possible to prevent tech scammers from editing bank webpages?
In a refund tech scam, tech scammers use Chrome Developer Tools to edit the HTML directly on the victim's bank webpage through a Remote Desktop (Teamviewer, AnyDesk, etc) to fool their victim into ...
- 107
17
votes
5
answers
5k
views
How can we avoid showing the literal path in the exception's stack trace?
When our in-house developed application (C#, ASP.NET) is throwing an exception, it displays a stack trace that contains path information like C:\users\DEVELOPER_FULL_NAME\path\some-module.cs. So it ...
- 311
23
votes
3
answers
6k
views
How to protect software from being deleted by antivirus? [duplicate]
I work for a publishing company and we are making interactive software that accompanies our books. The problem is that many clients complain that the antivirus keeps deleting parts of the software, ...
- 359
0
votes
3
answers
371
views
Protect Part of the Code
My company works with different developers from different studios, always sharing the code to everyone aboard. At the moment, we need to protect a part of the code, not from theft but from some ...
10
votes
3
answers
2k
views
Keeping secrets out of source control - are we just moving the problem?
I inherited some projects in which secrets were in source control in App.config and similar files. Fortunately it's not a public repository so the risk isn't as serious as it could have been. I'm ...
- 636
-2
votes
1
answer
73
views
Web Security (PHP) - Is it Secure to do downloading files & presenting with Headers to the End User ?
I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ?
We have customers invoice files stored in a server location (...
- 1,183
3
votes
4
answers
500
views
Locking access to a Class Library (C#)
I have been tasked with designing a class library that I am loathe to actually build. It is basically a huge backdoor to our software security. The idea was that it would only be accessible from one ...
3
votes
1
answer
462
views
How do you ensure external dependencies aren't a security risk?
We use quite a few external open source libraries in our projects, pulled in from Maven Central etc.
I was wondering what is best practice to ensuring that you don't introduce some sort of security ...
- 141
-2
votes
2
answers
627
views
Converting Java code run by dependency to native code
Is it, at least theoretically, possible to convert a Java application into native code that can be run by something else written in Java? One example of this could be a Minecraft Spigot server. You ...
- 3
3
votes
1
answer
96
views
What security practices do I employ when building a library that requires low level root access to certain devices and files?
Backstory
I am writing a library that accesses the kernel module, uinput which allows you to create or take control of devices in /dev/input/event#, and insert events into them.
A simple usecase would ...
- 3,505
4
votes
3
answers
1k
views
securing database username and password in a web framework
In most web application which deals with a database, one has to enter the DB creds in a settings or config file, like DATABASES variable in settings.py in Django. What is the general practice to ...
- 157
2
votes
1
answer
115
views
How to make associations security proof
When designing an application I usually stumble upon a problem I've never quite managed to handle properly.
Suppose you have Products and Orders. Usually in my data-access layer I have repositories ...
user260171
3
votes
1
answer
108
views
Should security code review involve stylistic culprits?
I have worked in company A for less than 1 year and I was given the task to do a security code review for a small project I was involved in the late 3 months. Until now I have been mainly been reading ...
- 232
1
vote
1
answer
317
views
Is opening a templating engine to users a bad idea?
My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site.
However, I'm not sure if it'...
- 209
-4
votes
1
answer
372
views
How to protect source code from being copied or leaked by employes [duplicate]
I'm a Java Developer, I created a Desktop Application , that is Free, and now I'm about to finish the payed version. my question is when I create a startup and other developers work on my code. How ...
- 101
5
votes
5
answers
8k
views
Is it safe to only use intval to sanitize user input for a database select?
Is it safe to only use intval to sanitize the user input for a database select, as in the following example?
$id = intval($_GET['id']);
$query = "SELECT * FROM table WHERE id='$id'";
- 53
2
votes
1
answer
2k
views
How can I make an object/class inaccessible to Reflection
I am building an API for minecraft called the Quantum API. We all know that reflection can be used to do some nasty stuff to classes, and even cause undefined behavior if used without care.
Is there ...
- 173
3
votes
2
answers
555
views
Is there any point in preventing developers from having a local copy of the database in their machine?
Is there any point to having a dedicated development database server(s) that all developers can use, i.e. they don't have a local copy of the db in their machines. Quite clearly, this will slow down ...
- 131
1
vote
1
answer
316
views
What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed
Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone.
...
- 13.9k
6
votes
3
answers
3k
views
Enforcing manual inclusion of a specific header file (banned.h)
Banned.h is a list of ANSI C functions that Microsoft is trying to persuade programmers to deprecate. I already know how to enforce automatic inclusion of banned.h (such as the answer to Ensuring that ...
- 191
1
vote
2
answers
2k
views
How do you make sure a .net client application is not being hacked to bypass authorization claims?
We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are:
CanOverrideSalesAmount
...
- 181
-1
votes
1
answer
178
views
How to verify that library assemblies originate from a given Web site?
How would the following solution be implemented? Would you need to put this code in each library assembly or just in the main assembly that is determining whether it is safe to call the library ...
1
vote
1
answer
2k
views
Is parsing a submitted JSON object safe?
I have a RESTful API, built in NODE.js that does what you would expect it to: consumes data and then makes it accessible. Currently, data being submitted to my server is nested form data:
data[0][...
- 166
0
votes
1
answer
249
views
Is the flyweight pattern a good security choice for managing permissions?
I'm designing a system, and it needs future expandability for the use of a permission system of some kind. I'm wondering if the flyweight pattern would be a good choice to implement this. I'm not ...
- 1,523
121
votes
8
answers
13k
views
Why does the US government disallow dynamic languages for secure projects?
I know some people that are currently working on a project for the US military (low security level, non-combat human resources type data).
An initial state of the project code was submitted to the ...
- 2,922
33
votes
8
answers
26k
views
How safe & trustworthy are hosting sites such as sourceforge, github or bitbucket for closed-source projects? [closed]
I am considering using sourceforge, bitbucket or github for managing source control for my business. I have open projects and I participate in open projects such as gcc. But I also have a business ...
- 551
0
votes
4
answers
226
views
Is there a way to check if redistributed code has been altered?
I would like to redistribute my app (PHP) in a way that the user gets the front end (presentation) layer which is using the API on my server through a web service.
I want the user to be able to alter ...
- 632
6
votes
1
answer
3k
views
How can we protect the namespace of an object in Javascript?
Continuing from my previous question: Javascript simple code to understand prototype-based OOP basics
Let's say we run into console this two separate objects(even if they are called child and parent ...
5
votes
1
answer
897
views
CSRF Protection with codeigniter
I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to ...
- 222
3
votes
4
answers
6k
views
Security Concerns with password storage in Scripting Languages (VBA)
The team I work with handles large amounts of consumer survey, and internal company metric data. Primarily the data is stored in a database, and we utilize various platforms and to work with that data,...
- 165
8
votes
1
answer
183
views
Are there any free tools to measure web project's performance, security and other standards?
Are there any open-source tools to measure the standard of a web application project? I want to verify my project for:
Possible security leaks (SQL Injection etc.)
Performance
Stability (in high ...
- 4,378
4
votes
2
answers
429
views
What should I do when I find sensitive information in version control?
Today I found what looked to be my supervisor's password in some code in version control. The password is to a database. He is very experienced and has explained before how to avoid having passwords ...
19
votes
6
answers
10k
views
How can I prevent a client from seeing my code written in an interpreted language?
I'm building a fairly complex interpreted program in Python. I've been working on most of this code for other purposes for a few months, and therefore don't want my client to be able to simply copy ...
James Eggers