View · Index

Security Guidelines

The maintained OpenACS packages are regularly tested with state-of-the-art web vulnerability scanners. The packages are developed using the following the guidelines.

Protecting against SQL injection (SQI):

Use colon-prefixed bind variables in SQL statements when possible (for local variables)

# use bindvars with local variables
set x 0
db_0or1row . {select * from acs_objects where object_id = :x}

or pass bind variables explicitly, using the -bind option

# use bind variables by passing a dictionary (attribute value list)
set bindvars {object_id 0 security_inherit_p t}
db_0or1row . {
   select * from acs_objects 
   where object_id = :object_id
   and security_inherit_p = :security_inherit_p
} -bind $bindvars

In case, bind-variables are not possible, use ns_dbquotevalue or ns_dbquotelist (see NaviServer documentation)
```
 set x 0
 db_0or1row . [subst {select * from acs_objects where object_id = [ns_dbquotevalue $x]}] 
```
Manual page
In general, avoid using double-quoted SQL statements whenever possible to avoid unescaped substitutions.

Protecting against cross side scripting (XSS):

Validate all input values using page contracts with value checkers, and validate all form variables in the form specification.
Make sure that Content Security Policies (CSP) are activated in the package parameters. When you have to relax the CSP roles, use "security::csp::require" as local as possible (e.g. on the page level) and not on the site level.

Popular tags

17 (1), 5.10 (1), 5.10.0 (2), 5.10.1 (1), 5.9.0 (3), 5.9.1 (4), ad_form (1), ADP (1), ajax (1), aolserver (1), asynchronous (2), bgdelivery (3), bootstrap (1), bugtracker (1), CentOS (1), COMET (1), compatibility (1), CSP (1), CSRF (1), cvs (3), debian (7), docker (2), docker-compose (1), emacs (2), engineering-standards (1), exec (1), fedora (1), FreeBSD (1), guidelines (1), host-node-map (1)

No registered users in community xowiki
in last 30 minutes

Contributors

OpenACS.org

References to this Page: en:coding-standards-index Categories: Coding Standards (OpenACS.org)