4 ms·

Maybe you can answer one thing that pickled my mind, no mention of CSRF protections,etc in the documentation that seems to cover quite a few bases. (apart from

Maybe you can answer one thing that pickled my mind, no mention of CSRF protections,etc in the documentation that seems to cover quite a few bases. (apart from one xss symbol application that I couldn't fully decipher).

zelphirkalt 1y ago
XSS should not be a problem with many Scheme dialects and Lisps, unless you render JS from user input. This is because SXML does not treat HTML as a mere string, but as structured data (as any sane library should, but very few do). So if you get some user input and want to display that in some label or paragraph or whatever, then SXML is aware what is a tag and what is text content of the tag, due to how you build the SXML expression. This is not PHP or something. I do not know, whether GNU Artanis makes use of SXML all the way, but I think it is very likely, since SXML is in GNU Guile's standard library.
- whizzter 1y ago
  You're talking about injection attacks when escaping isn't present. CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply, but whose login cookie would authorize the request at the target. Many frameworks inject an per-user "authentication" cookie in form's that is validated upon request, this way an attacker cannot trick the users browser to submit data since they don't have the correct CSRF-cookie. https://owasp.org/www-community/attacks/csrf https://owasp.org/www-community/attacks/csrf https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF https://developer.mozilla.org/en-US/docs/Web/Security/Attack...
- robertlagrant 1y ago
  Even if it is structured data, it's ultimately passed to the browser as a string. If I put text in between two tags, and that text came from user input, how is it going to solve that? Does it autoencode as html entity tags anything coming out in a text node?
  - zelphirkalt 1y ago
    While working on the HTML document in your program, you have it always represented as a tree of nodes, a nested list often. When you want to insert user input, that user input is available as a string (unless you first turn it into something else). When you put a string into that nested list, and then at the very end, when you form the response, ask SXML to turn your tree into the HTML string, SXML will error, because it wouldn't know how to handle the string. (All the other nodes are symbols with potentially subtrees in them, which are also symbols with potentially more subtress in them.) If you put your user input into one such node as a value of that node, lets say a paragraph tag <p>, then SXML sees the user input as it is, a string. It will make sure, that when it turns the tree into HTML, that string remains merely a string, by escaping things, so that for example when your string is <evil-tag-with attrs="bla"> this is exactly what will be seen as text inside your paragraph text, and not be interpreted. Basically, SXML will render it like: "Oh, you want some string to be inside your p tag? Sure, can do ... This is what you wanted to be displayed to the user ... You didn't want to run that, did you? Nahh, because then you wouldn't have passed it in the SXML as text content of a p tag." So I think the answer to your question is "Yes.".
    - robertlagrant 1y ago
      Ah okay - so it uses some special type to represent html-encoded text, which is then valid to shove inside a text element? That sounds quite nice.
      - matrss 1y ago
        I don't think it uses some special type in any way. Rather, if you use sxml to build html in scheme and have a node in there that is a string, then the natural way to serialize this sxml into html will be to safely quote the string. Afterall, if you wanted html tags to be preserved and interpreted in the output, you would first parse the string into sxml and put that into your document. This is the difference between working with structured data vs. plain string interpolation. But of course this only applies when you use sxml. Artanis apparently can also use plain strings or templates as responses, in which case you will have to take care of safely encoding things too.
shakna 1y ago
CSRF wasn't really a concern, because we weren't requesting anything from anybody else, and didn't use cookies, etc. But, specifying your own headers is easy, and we had it in a macro we used for our routes. So instead, to rip from the manual: (response-emit body #:status 200 #:headers '( (Content-Type . application/json) (X-Frame-Options . DENY) ) #:mtime (current-time))
- whizzter 1y ago
  This is an example of clickjacking protection, CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply but whose login cookie would authorize the request at the target. Many frameworks inject an per-user "authentication" cookie in form's that is validated upon request, this way an attacker cannot trick the users browser to submit data since they don't have the correct cookie. https://owasp.org/www-community/attacks/csrf https://owasp.org/www-community/attacks/csrf https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF https://developer.mozilla.org/en-US/docs/Web/Security/Attack...
  - shakna 1y ago
    If your problem is in authorisation, then it will be in your business logic, of what a user looks like, what the hierarchy is, and so on. It shouldn't live in your framework. And the standard ways of doing that, generating single use tokens, will work the way they usually do. As I said... I didn't use cookies. Which means none of what you listed applied in the first place. Logins were entirely ephemeral and died after a single session ended - as pains were taken to ensure anonymity.

zelphirkalt 1y ago

XSS should not be a problem with many Scheme dialects and Lisps, unless you render JS from user input. This is because SXML does not treat HTML as a mere string, but as structured data (as any sane library should, but very few do). So if you get some user input and want to display that in some label or paragraph or whatever, then SXML is aware what is a tag and what is text content of the tag, due to how you build the SXML expression. This is not PHP or something. I do not know, whether GNU Artanis makes use of SXML all the way, but I think it is very likely, since SXML is in GNU Guile's standard library.

whizzter 1y ago
You're talking about injection attacks when escaping isn't present. CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply, but whose login cookie would authorize the request at the target. Many frameworks inject an per-user "authentication" cookie in form's that is validated upon request, this way an attacker cannot trick the users browser to submit data since they don't have the correct CSRF-cookie. https://owasp.org/www-community/attacks/csrf https://owasp.org/www-community/attacks/csrf https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF https://developer.mozilla.org/en-US/docs/Web/Security/Attack...
robertlagrant 1y ago
Even if it is structured data, it's ultimately passed to the browser as a string. If I put text in between two tags, and that text came from user input, how is it going to solve that? Does it autoencode as html entity tags anything coming out in a text node?
- zelphirkalt 1y ago
  While working on the HTML document in your program, you have it always represented as a tree of nodes, a nested list often. When you want to insert user input, that user input is available as a string (unless you first turn it into something else). When you put a string into that nested list, and then at the very end, when you form the response, ask SXML to turn your tree into the HTML string, SXML will error, because it wouldn't know how to handle the string. (All the other nodes are symbols with potentially subtrees in them, which are also symbols with potentially more subtress in them.) If you put your user input into one such node as a value of that node, lets say a paragraph tag <p>, then SXML sees the user input as it is, a string. It will make sure, that when it turns the tree into HTML, that string remains merely a string, by escaping things, so that for example when your string is <evil-tag-with attrs="bla"> this is exactly what will be seen as text inside your paragraph text, and not be interpreted. Basically, SXML will render it like: "Oh, you want some string to be inside your p tag? Sure, can do ... This is what you wanted to be displayed to the user ... You didn't want to run that, did you? Nahh, because then you wouldn't have passed it in the SXML as text content of a p tag." So I think the answer to your question is "Yes.".
  - robertlagrant 1y ago
    Ah okay - so it uses some special type to represent html-encoded text, which is then valid to shove inside a text element? That sounds quite nice.
    - matrss 1y ago
      I don't think it uses some special type in any way. Rather, if you use sxml to build html in scheme and have a node in there that is a string, then the natural way to serialize this sxml into html will be to safely quote the string. Afterall, if you wanted html tags to be preserved and interpreted in the output, you would first parse the string into sxml and put that into your document. This is the difference between working with structured data vs. plain string interpolation. But of course this only applies when you use sxml. Artanis apparently can also use plain strings or templates as responses, in which case you will have to take care of safely encoding things too.

shakna 1y ago

CSRF wasn't really a concern, because we weren't requesting anything from anybody else, and didn't use cookies, etc. But, specifying your own headers is easy, and we had it in a macro we used for our routes. So instead, to rip from the manual: (response-emit body #:status 200 #:headers '( (Content-Type . application/json) (X-Frame-Options . DENY) ) #:mtime (current-time))

whizzter 1y ago
This is an example of clickjacking protection, CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply but whose login cookie would authorize the request at the target. Many frameworks inject an per-user "authentication" cookie in form's that is validated upon request, this way an attacker cannot trick the users browser to submit data since they don't have the correct cookie. https://owasp.org/www-community/attacks/csrf https://owasp.org/www-community/attacks/csrf https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF https://developer.mozilla.org/en-US/docs/Web/Security/Attack...
- shakna 1y ago
  If your problem is in authorisation, then it will be in your business logic, of what a user looks like, what the hierarchy is, and so on. It shouldn't live in your framework. And the standard ways of doing that, generating single use tokens, will work the way they usually do. As I said... I didn't use cookies. Which means none of what you listed applied in the first place. Logins were entirely ephemeral and died after a single session ended - as pains were taken to ensure anonymity.