Questions tagged [code-security]

Code Security is the process of protecting against theft and unauthorized distribution.

Filter by
Sorted by
Tagged with
4 votes
1 answer
342 views

If a code inspection tool finds a "heap inspection" vulnerability, is that relevant if the code is for a web app running on a private server?

Recently, at the organization I work for, we've been using a static code inspection tool. One of the more interesting findings is that private information, such as passwords, may be stored in the heap ...
user avatar
  • 2,397
1 vote
4 answers
290 views

How can Data security be ensured in an open source software?

In open source projects handling user data in a secure manner can be managed, for example through encryption and password protected functionality. What I'd like to create is a way for the user to ...
user avatar
-4 votes
4 answers
2k views

Since `strcpy`, `strcat`, and `sprintf` are dangerous, what shall we use in stead of them?

In Computer Systems: a Programmer's Perspective, Unfortunately, a number of commonly used library functions, including strcpy, strcat, and sprintf, have the property that they can generate a byte ...
user avatar
  • 5,301
0 votes
0 answers
43 views

How secure LocalStorage on a SPA

I'm developing an Ionic 4 based (Angular) web application. It has a lot of logic on it and needs to store session specific data (such as a JWT, selected language, among other preferences and temporary ...
user avatar
  • 139
-3 votes
4 answers
904 views

Is it possible to prevent tech scammers from editing bank webpages?

In a refund tech scam, tech scammers use Chrome Developer Tools to edit the HTML directly on the victim's bank webpage through a Remote Desktop (Teamviewer, AnyDesk, etc) to fool their victim into ...
user avatar
16 votes
5 answers
4k views

How can we avoid showing the literal path in the exception's stack trace?

When our in-house developed application (C#, ASP.NET) is throwing an exception, it displays a stack trace that contains path information like C:\users\DEVELOPER_FULL_NAME\path\some-module.cs. So it ...
user avatar
23 votes
3 answers
5k views

How to protect software from being deleted by antivirus? [duplicate]

I work for a publishing company and we are making interactive software that accompanies our books. The problem is that many clients complain that the antivirus keeps deleting parts of the software, ...
user avatar
  • 359
0 votes
3 answers
368 views

Protect Part of the Code

My company works with different developers from different studios, always sharing the code to everyone aboard. At the moment, we need to protect a part of the code, not from theft but from some ...
user avatar
10 votes
3 answers
2k views

Keeping secrets out of source control - are we just moving the problem?

I inherited some projects in which secrets were in source control in App.config and similar files. Fortunately it's not a public repository so the risk isn't as serious as it could have been. I'm ...
user avatar
-2 votes
1 answer
71 views

Web Security (PHP) - Is it Secure to do downloading files & presenting with Headers to the End User ?

I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ? We have customers invoice files stored in a server location (...
user avatar
  • 1,163
3 votes
4 answers
436 views

Locking access to a Class Library (C#)

I have been tasked with designing a class library that I am loathe to actually build. It is basically a huge backdoor to our software security. The idea was that it would only be accessible from one ...
user avatar
3 votes
1 answer
413 views

How do you ensure external dependencies aren't a security risk?

We use quite a few external open source libraries in our projects, pulled in from Maven Central etc. I was wondering what is best practice to ensuring that you don't introduce some sort of security ...
user avatar
  • 141
-2 votes
2 answers
600 views

Converting Java code run by dependency to native code

Is it, at least theoretically, possible to convert a Java application into native code that can be run by something else written in Java? One example of this could be a Minecraft Spigot server. You ...
user avatar
  • 3
3 votes
1 answer
96 views

What security practices do I employ when building a library that requires low level root access to certain devices and files?

Backstory I am writing a library that accesses the kernel module, uinput which allows you to create or take control of devices in /dev/input/event#, and insert events into them. A simple usecase would ...
user avatar
  • 3,379
4 votes
3 answers
1k views

securing database username and password in a web framework

In most web application which deals with a database, one has to enter the DB creds in a settings or config file, like DATABASES variable in settings.py in Django. What is the general practice to ...
user avatar
  • 157
2 votes
1 answer
115 views

How to make associations security proof

When designing an application I usually stumble upon a problem I've never quite managed to handle properly. Suppose you have Products and Orders. Usually in my data-access layer I have repositories ...
user avatar
3 votes
1 answer
106 views

Should security code review involve stylistic culprits?

I have worked in company A for less than 1 year and I was given the task to do a security code review for a small project I was involved in the late 3 months. Until now I have been mainly been reading ...
user avatar
  • 232
1 vote
1 answer
313 views

Is opening a templating engine to users a bad idea?

My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site. However, I'm not sure if it'...
user avatar
-4 votes
1 answer
346 views

How to protect source code from being copied or leaked by employes [duplicate]

I'm a Java Developer, I created a Desktop Application , that is Free, and now I'm about to finish the payed version. my question is when I create a startup and other developers work on my code. How ...
user avatar
  • 101
4 votes
5 answers
7k views

Is it safe to only use intval to sanitize user input for a database select?

Is it safe to only use intval to sanitize the user input for a database select, as in the following example? $id = intval($_GET['id']); $query = "SELECT * FROM table WHERE id='$id'";
user avatar
  • 43
2 votes
1 answer
2k views

How can I make an object/class inaccessible to Reflection

I am building an API for minecraft called the Quantum API. We all know that reflection can be used to do some nasty stuff to classes, and even cause undefined behavior if used without care. Is there ...
user avatar
  • 173
3 votes
2 answers
494 views

Is there any point in preventing developers from having a local copy of the database in their machine?

Is there any point to having a dedicated development database server(s) that all developers can use, i.e. they don't have a local copy of the db in their machines. Quite clearly, this will slow down ...
user avatar
  • 131
1 vote
1 answer
298 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
user avatar
  • 13.8k
6 votes
3 answers
3k views

Enforcing manual inclusion of a specific header file (banned.h)

Banned.h is a list of ANSI C functions that Microsoft is trying to persuade programmers to deprecate. I already know how to enforce automatic inclusion of banned.h (such as the answer to Ensuring that ...
user avatar
  • 191
1 vote
2 answers
2k views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
user avatar
  • 181
-1 votes
1 answer
178 views

How to verify that library assemblies originate from a given Web site?

How would the following solution be implemented? Would you need to put this code in each library assembly or just in the main assembly that is determining whether it is safe to call the library ...
user avatar
1 vote
1 answer
2k views

Is parsing a submitted JSON object safe?

I have a RESTful API, built in NODE.js that does what you would expect it to: consumes data and then makes it accessible. Currently, data being submitted to my server is nested form data: data[0][...
user avatar
  • 166
0 votes
1 answer
247 views

Is the flyweight pattern a good security choice for managing permissions?

I'm designing a system, and it needs future expandability for the use of a permission system of some kind. I'm wondering if the flyweight pattern would be a good choice to implement this. I'm not ...
user avatar
  • 1,533
122 votes
8 answers
13k views

Why does the US government disallow dynamic languages for secure projects?

I know some people that are currently working on a project for the US military (low security level, non-combat human resources type data). An initial state of the project code was submitted to the ...
user avatar
  • 2,922
33 votes
8 answers
26k views

How safe & trustworthy are hosting sites such as sourceforge, github or bitbucket for closed-source projects? [closed]

I am considering using sourceforge, bitbucket or github for managing source control for my business. I have open projects and I participate in open projects such as gcc. But I also have a business ...
user avatar
  • 551
0 votes
4 answers
222 views

Is there a way to check if redistributed code has been altered?

I would like to redistribute my app (PHP) in a way that the user gets the front end (presentation) layer which is using the API on my server through a web service. I want the user to be able to alter ...
user avatar
6 votes
1 answer
3k views

How can we protect the namespace of an object in Javascript?

Continuing from my previous question: Javascript simple code to understand prototype-based OOP basics Let's say we run into console this two separate objects(even if they are called child and parent ...
user avatar
5 votes
1 answer
868 views

CSRF Protection with codeigniter

I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to ...
user avatar
3 votes
4 answers
6k views

Security Concerns with password storage in Scripting Languages (VBA)

The team I work with handles large amounts of consumer survey, and internal company metric data. Primarily the data is stored in a database, and we utilize various platforms and to work with that data,...
user avatar
8 votes
1 answer
180 views

Are there any free tools to measure web project's performance, security and other standards?

Are there any open-source tools to measure the standard of a web application project? I want to verify my project for: Possible security leaks (SQL Injection etc.) Performance Stability (in high ...
user avatar
  • 4,358
4 votes
2 answers
416 views

What should I do when I find sensitive information in version control?

Today I found what looked to be my supervisor's password in some code in version control. The password is to a database. He is very experienced and has explained before how to avoid having passwords ...
user avatar
18 votes
6 answers
10k views

How can I prevent a client from seeing my code written in an interpreted language?

I'm building a fairly complex interpreted program in Python. I've been working on most of this code for other purposes for a few months, and therefore don't want my client to be able to simply copy ...
user avatar