5 ms·

How is it it a security risk to name a constant in source code?

dr_zoidberg 8y ago
He linked a resource that explains visual spoofing, an "attack technique" in which an attacker registers a domain that renders exaclty the same as yours, but actually isn't (because it uses unicode points which render the same --or very similar-- to latin alphabet letters). I woulnd't go as far as saying "it's a security risk", but on some situations it may lead to weird bugs in which you think you're referring to one constant/variable and you're actually referring to another (visually equivalent/the same) const/var.
pawelmurias 8y ago
it can be used to create malicious pull requests that are visually indistinguishable from correct ones
- dragonwriter 8y ago
  > it can be used to create malicious pull requests that are visually indistinguishable from correct ones If your only check on the correctness of submitted code is visual inspection, you've got a much bigger problem than Unicode confusability.
  - saagarjha 8y ago
    How do you check your code? Presumably, you’re not able to exercise the full range of inputs, so at some point you will have to look at the code and figure out what it is doing…
    - heartbreak 8y ago
      Which means you'd notice the value of a constant being exfiltrated, since a maliciously named constant doesn't magically expose secrets outside of the application.
      - majewsky 8y ago
        I suggest you take a look at some of the submissions in e.g. the Underhanded C Contest. Where it can be excruciatingly hard to figure out where the backdoor is even though you know that the code has one.
  - phendrenad2 8y ago
    Do you apply formal verification to your codebases to make sure there are to cleverly-crafted backdoors that still pass all the unit tests? Would be interesting to hear about.
xiphias2 8y ago
In Ruby it can easily be used to submit malicious source code to a repository (for example the reviewers thinking that a variable is set to some value, when in fact a new variable is created).
- heartbreak 8y ago
  An attacker would still have to _do_ something with their new maliciously named constant, which would be as noticeable as any other malicious contribution. This is grasping at straws.
  - rileymat2 8y ago
    This is probably pretty overblown, but if a function takes a flag, it would be possible to pass in a different value to the function than appears to be passed in at first glance.
  - xiphias2 8y ago
    Not really, just thinking that an operation changes a variable when it in fact doesn't is enough to introduce a security vulnerability.

He linked a resource that explains visual spoofing, an "attack technique" in which an attacker registers a domain that renders exaclty the same as yours, but actually isn't (because it uses unicode points which render the same --or very similar-- to latin alphabet letters). I woulnd't go as far as saying "it's a security risk", but on some situations it may lead to weird bugs in which you think you're referring to one constant/variable and you're actually referring to another (visually equivalent/the same) const/var.

pawelmurias 8y ago

it can be used to create malicious pull requests that are visually indistinguishable from correct ones

dragonwriter 8y ago
> it can be used to create malicious pull requests that are visually indistinguishable from correct ones If your only check on the correctness of submitted code is visual inspection, you've got a much bigger problem than Unicode confusability.
- saagarjha 8y ago
  How do you check your code? Presumably, you’re not able to exercise the full range of inputs, so at some point you will have to look at the code and figure out what it is doing…
  - heartbreak 8y ago
    Which means you'd notice the value of a constant being exfiltrated, since a maliciously named constant doesn't magically expose secrets outside of the application.
    - majewsky 8y ago
      I suggest you take a look at some of the submissions in e.g. the Underhanded C Contest. Where it can be excruciatingly hard to figure out where the backdoor is even though you know that the code has one.
- phendrenad2 8y ago
  Do you apply formal verification to your codebases to make sure there are to cleverly-crafted backdoors that still pass all the unit tests? Would be interesting to hear about.

xiphias2 8y ago

In Ruby it can easily be used to submit malicious source code to a repository (for example the reviewers thinking that a variable is set to some value, when in fact a new variable is created).

heartbreak 8y ago
An attacker would still have to _do_ something with their new maliciously named constant, which would be as noticeable as any other malicious contribution. This is grasping at straws.
- rileymat2 8y ago
  This is probably pretty overblown, but if a function takes a flag, it would be possible to pass in a different value to the function than appears to be passed in at first glance.
- xiphias2 8y ago
  Not really, just thinking that an operation changes a variable when it in fact doesn't is enough to introduce a security vulnerability.