3 ms·

Really though, Clojure web apps are at the php-no-framework level security days, not joking. The most used HTML templater(hiccup) doesn't do any secure output

Really though, Clojure web apps are at the php-no-framework level security days, not joking. The most used HTML templater(hiccup) doesn't do any secure output escaping, bad password/session management, auth*, sql injection, bad encryption methods, its all there.

vlaaad 7y ago
HTML templater has nothing to do with password/session management, auth, sql and encription, if your does, it does the wrong things.
- tetraca 7y ago
  I think you spliced that sentence wrong. It's bad templating, /along with/ bad session management, auth, sql, and encryption tools.
  - vlaaad 7y ago
    Do you have any evidence to support these claims? I've never had such problems, please see my other comment about similar concerns: https://news.ycombinator.com/item?id=20848195 https://news.ycombinator.com/item?id=20848195
    - tetraca 7y ago
      I don't because I'm only speaking about how one should parse the sentence, not the facts of the sentence.
hombre_fatal 7y ago
You're right about Hiccup, but I don't understand the rest of your post. What common SQL solution in Clojure are people using that introduces SQL injection, for example?
didibus 7y ago
Hiccup has functionality to perform escaping with `h`. It doesn't do it by default though, for performance reasons and nesting of Hiccup in Hiccup. Normally, you'd just want to sanitize right before returning your response. Doing it that way you can also perform more selective sanitation if needed. Hiccup2 does sanitation by default, still in beta though. The common SQL lib is java.jdbc or next.jdbc and they use prepared statements by default. Can you explain more where you see common risks for SQL injections? I'm not sure what you mean by bad password and session management? Normally, the common lib people use is ring-defaults https://github.com/ring-clojure/ring-defaults https://github.com/ring-clojure/ring-defaults what about these do you feel are insufficient? Maybe do a pull request about it. Auth and encryption I agree, but the untold reason is that people just use Java bountycastle and Apache Shiro or other for that. Buddy is the most popular Clojure one https://github.com/funcool/buddy https://github.com/funcool/buddy , but honestly, for that stuff, you want something super battle tested, that means popular, and Clojure as a whole isn't popular enough for that, so really just pull in a Java lib done, it works flawlessly within Clojure.
- Kalium 7y ago
  > Hiccup has functionality to perform escaping with `h`. It doesn't do it by default though, for performance reasons and nesting of Hiccup in Hiccup. Normally, you'd just want to sanitize right before returning your response. One of the things that Rails' templates gets completely right is that it knows when something is nested and when it's going to be returned immediately. It is thus able to do its automatic escaping right before returning a response and not before. At this point in history, I think this is the baseline behavior all templating systems should meet. Requiring users to remember to manually escape every output every time is begging for exploitation. Such a design error only strengthens the case that hiccup is not appropriate for serious use at this time.
  - didibus 7y ago
    It seems Rails used to default to not escaping as well, but in Rails 3 they switched to escape by default. And from what I'm reading, nested helpers do suffer from the over escaping, and in fact they warn not to blindly html_safe them. But I admit, I can't find very new guides on latest versions, are you saying ERB now tracks nesting and only escape once at the end? That's actually what hiccup2 does as well by the way. I admit, it is a nicer behavior, and I'm not sure why hiccup2 hasn't gained more traction since it released, but you are free to use it, it's part of the normal hiccup release, just require hiccup2 instead of hiccup. But hiccup is not the only popular Clojure HTML templating lib. Selmer, Clostache and Stencil which are much more ERB or Django like, both HTML escape by default.

vlaaad 7y ago

HTML templater has nothing to do with password/session management, auth, sql and encription, if your does, it does the wrong things.

tetraca 7y ago
I think you spliced that sentence wrong. It's bad templating, /along with/ bad session management, auth, sql, and encryption tools.
- vlaaad 7y ago
  Do you have any evidence to support these claims? I've never had such problems, please see my other comment about similar concerns: https://news.ycombinator.com/item?id=20848195 https://news.ycombinator.com/item?id=20848195
  - tetraca 7y ago
    I don't because I'm only speaking about how one should parse the sentence, not the facts of the sentence.

hombre_fatal 7y ago

You're right about Hiccup, but I don't understand the rest of your post. What common SQL solution in Clojure are people using that introduces SQL injection, for example?

didibus 7y ago

Hiccup has functionality to perform escaping with `h`. It doesn't do it by default though, for performance reasons and nesting of Hiccup in Hiccup. Normally, you'd just want to sanitize right before returning your response. Doing it that way you can also perform more selective sanitation if needed. Hiccup2 does sanitation by default, still in beta though. The common SQL lib is java.jdbc or next.jdbc and they use prepared statements by default. Can you explain more where you see common risks for SQL injections? I'm not sure what you mean by bad password and session management? Normally, the common lib people use is ring-defaults https://github.com/ring-clojure/ring-defaults https://github.com/ring-clojure/ring-defaults what about these do you feel are insufficient? Maybe do a pull request about it. Auth and encryption I agree, but the untold reason is that people just use Java bountycastle and Apache Shiro or other for that. Buddy is the most popular Clojure one https://github.com/funcool/buddy https://github.com/funcool/buddy , but honestly, for that stuff, you want something super battle tested, that means popular, and Clojure as a whole isn't popular enough for that, so really just pull in a Java lib done, it works flawlessly within Clojure.

Kalium 7y ago
> Hiccup has functionality to perform escaping with `h`. It doesn't do it by default though, for performance reasons and nesting of Hiccup in Hiccup. Normally, you'd just want to sanitize right before returning your response. One of the things that Rails' templates gets completely right is that it knows when something is nested and when it's going to be returned immediately. It is thus able to do its automatic escaping right before returning a response and not before. At this point in history, I think this is the baseline behavior all templating systems should meet. Requiring users to remember to manually escape every output every time is begging for exploitation. Such a design error only strengthens the case that hiccup is not appropriate for serious use at this time.
- didibus 7y ago
  It seems Rails used to default to not escaping as well, but in Rails 3 they switched to escape by default. And from what I'm reading, nested helpers do suffer from the over escaping, and in fact they warn not to blindly html_safe them. But I admit, I can't find very new guides on latest versions, are you saying ERB now tracks nesting and only escape once at the end? That's actually what hiccup2 does as well by the way. I admit, it is a nicer behavior, and I'm not sure why hiccup2 hasn't gained more traction since it released, but you are free to use it, it's part of the normal hiccup release, just require hiccup2 instead of hiccup. But hiccup is not the only popular Clojure HTML templating lib. Selmer, Clostache and Stencil which are much more ERB or Django like, both HTML escape by default.