Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [code-security]

The tag has no usage guidance.

6
votes
3answers
328 views

Keeping secrets out of source control - are we just moving the problem?

I inherited some projects in which secrets were in source control in App.config and similar files. Fortunately it's not a public repository so the risk isn't as serious as it could have been. I'm ...
-2
votes
1answer
49 views

Web Security (PHP) - Is it Secure to do downloading files & presenting with Headers to the End User ?

I have security question that i am not sure if this approach is safe and secure way to download a file and present to a web user ? We have customers invoice files stored in a server location (...
3
votes
4answers
326 views

Locking access to a Class Library (C#)

I have been tasked with designing a class library that I am loathe to actually build. It is basically a huge backdoor to our software security. The idea was that it would only be accessible from one ...
3
votes
1answer
195 views

How do you ensure external dependencies aren't a security risk?

We use quite a few external open source libraries in our projects, pulled in from Maven Central etc. I was wondering what is best practice to ensuring that you don't introduce some sort of security ...
-2
votes
2answers
202 views

Converting Java code run by dependency to native code

Is it, at least theoretically, possible to convert a Java application into native code that can be run by something else written in Java? One example of this could be a Minecraft Spigot server. You ...
3
votes
1answer
86 views

What security practices do I employ when building a library that requires low level root access to certain devices and files?

Backstory I am writing a library that accesses the kernel module, uinput which allows you to create or take control of devices in /dev/input/event#, and insert events into them. A simple usecase ...
3
votes
3answers
406 views

securing database username and password in a web framework

In most web application which deals with a database, one has to enter the DB creds in a settings or config file, like DATABASES variable in settings.py in Django. What is the general practice to ...
2
votes
1answer
113 views

How to make associations security proof

When designing an application I usually stumble upon a problem I've never quite managed to handle properly. Suppose you have Products and Orders. Usually in my data-access layer I have repositories ...
3
votes
1answer
93 views

Should security code review involve stylistic culprits?

I have worked in company A for less than 1 year and I was given the task to do a security code review for a small project I was involved in the late 3 months. Until now I have been mainly been reading ...
1
vote
1answer
174 views

Is opening a templating engine to users a bad idea?

My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site. However, I'm not sure if it'...
-4
votes
1answer
267 views

How to protect source code from being copied or leaked by employes [duplicate]

I'm a Java Developer, I created a Desktop Application , that is Free, and now I'm about to finish the payed version. my question is when I create a startup and other developers work on my code. How ...
3
votes
5answers
3k views

Is it safe to only use intval to sanitize user input for a database select?

Is it safe to only use intval to sanitize the user input for a database select, as in the following example? $id = intval($_GET['id']); $query = "SELECT * FROM table WHERE id='$id'";
1
vote
1answer
691 views

How can I make an object/class inaccessible to Reflection

I am building an API for minecraft called the Quantum API. We all know that reflection can be used to do some nasty stuff to classes, and even cause undefined behavior if used without care. Is there ...
3
votes
2answers
217 views

Is there any point in preventing developers from having a local copy of the database in their machine?

Is there any point to having a dedicated development database server(s) that all developers can use, i.e. they don't have a local copy of the db in their machines. Quite clearly, this will slow down ...
1
vote
1answer
204 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
5
votes
3answers
2k views

Enforcing manual inclusion of a specific header file (banned.h)

Banned.h is a list of ANSI C functions that Microsoft is trying to persuade programmers to deprecate. I already know how to enforce automatic inclusion of banned.h (such as the answer to Ensuring that ...
1
vote
2answers
2k views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
-1
votes
1answer
171 views

How to verify that library assemblies originate from a given Web site?

How would the following solution be implemented? Would you need to put this code in each library assembly or just in the main assembly that is determining whether it is safe to call the library ...
1
vote
1answer
1k views

Is parsing a submitted JSON object safe?

I have a RESTful API, built in NODE.js that does what you would expect it to: consumes data and then makes it accessible. Currently, data being submitted to my server is nested form data: data[0][...
0
votes
1answer
225 views

Is the flyweight pattern a good security choice for managing permissions?

I'm designing a system, and it needs future expandability for the use of a permission system of some kind. I'm wondering if the flyweight pattern would be a good choice to implement this. I'm not ...
120
votes
8answers
11k views

Why does the US government disallow dynamic languages for secure projects?

I know some people that are currently working on a project for the US military (low security level, non-combat human resources type data). An initial state of the project code was submitted to the ...
32
votes
8answers
24k views

How safe & trustworthy are hosting sites such as sourceforge, github or bitbucket for closed-source projects? [closed]

I am considering using sourceforge, bitbucket or github for managing source control for my business. I have open projects and I participate in open projects such as gcc. But I also have a business ...
0
votes
4answers
203 views

Is there a way to check if redistributed code has been altered?

I would like to redistribute my app (PHP) in a way that the user gets the front end (presentation) layer which is using the API on my server through a web service. I want the user to be able to alter ...
6
votes
1answer
3k views

How can we protect the namespace of an object in Javascript?

Continuing from my previous question: Javascript simple code to understand prototype-based OOP basics Let's say we run into console this two separate objects(even if they are called child and parent ...
5
votes
1answer
648 views

CSRF Protection with codeigniter

I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to ...
2
votes
4answers
5k views

Security Concerns with password storage in Scripting Languages (VBA)

The team I work with handles large amounts of consumer survey, and internal company metric data. Primarily the data is stored in a database, and we utilize various platforms and to work with that data,...
8
votes
1answer
171 views

Are there any free tools to measure web project's performance, security and other standards?

Are there any open-source tools to measure the standard of a web application project? I want to verify my project for: Possible security leaks (SQL Injection etc.) Performance Stability (in high ...
4
votes
2answers
367 views

What should I do when I find sensitive information in version control?

Today I found what looked to be my supervisor's password in some code in version control. The password is to a database. He is very experienced and has explained before how to avoid having passwords ...
16
votes
6answers
8k views

How can I prevent a client from seeing my code written in an interpreted language?

I'm building a fairly complex interpreted program in Python. I've been working on most of this code for other purposes for a few months, and therefore don't want my client to be able to simply copy ...