5 ms·
Can someone help to compile a good security policy and guideline for web apps? I guess every web app should have a page dedicated to security similar to privac
by laktek 17y ago
Can someone help to compile a good security policy and guideline for web apps?
I guess every web app should have a page dedicated to security similar to privacy policy and terms of service.
What are the essential information should go there? Special email dedicated to report security issues? PGP key to encrypt emails? and What else?
- lupin_sansei 17y agoDon't trust any data that comes from outside your app (urls, querystrings, http request headers, databases, files) and you'll be right. Perl's Taint Mode enforces this automatically. Don't know if any other languages have it? http://www.webreference.com/programming/perl/taint/ http://www.webreference.com/programming/perl/taint/
- jrockway 17y agoI don't think taint mode is helpful for this. All data comes from outside of your program, but you somehow still have to display it. As we've seen recently, this is hard to get right. Escaping HTML is one thing, but what if you want to let a user type in a URL? Make sure to exclude javascript: URLs. Even if you whitelist only "http://... http://... URLs, how do you know that a browser bug won't allow an attacker to inject JavaScript, compromising any account used by a user of that web browser? Basically, web browsers need taint mode. The programming language that produces the web page is a whole other issue.
- ewiethoff 17y agoIIRC, Ruby lets you set taintedness Safe Levels with the -T command-line option or setting $SAFE per thread.