Coding Practices Flashcards
Coding Practices
Is there any software hosted by LabLynx that doesn’t utilize some form of untrusted input?
No. This includes integrations, where a file name or data from an API might contain data that should be considered untrusted.
Coding Practices
Can bad inputs compromise security?
Yes. Sql Injection and XSS are two examples. Typically, an escape character is included, followed by a command that might be executed,
Coding Practices
Can bad inputs compromise software performance or reliability?
Yes. Bad data can cause errors that are tough to trace down in front end, backend and integration services.
Coding Practices
What hazardous characters might cause issues in inputs?
Escape characters, which are different for each language.
Special, reserved characters.
new line and null characters
Path alteration characters (dot dot slash)
OWasp Coding Practices has list of common characters
Coding Practices
Can data type and data length result in inputs cause application problems, or security problems?
Yes. Unvalidated types and lengths can cause problems from user confusion to application errors.
Coding Practices
What techniques might be used to ensure input is “safe”
Alerts to users that input is invalid
Escaping / sanitizing all inputs
Encoding data placed in form inputs, by application or user
Using parameterized database queries. ORMs build this in.
Ensure consistent text encoding between application layers (UTF8, ASCII, etc)
Coding Practices
When should consideration be made to input validation?
For all work, at all times. If not included in specifications, it remains in scope for development and QC.
Coding Practices
When errors occur, what should be presented to users, if due to user activity?
Generic information. This may suggest an action to take. It should not provide information that might be used to compromise the system.
Coding Practices
When errors occur, what should be logged?
The error, as well as any associated information that would provide information about a specific record, or file, or API I/O relevant to understanding what data, and where in the process the error occurred. Date, time, and, where applicable, the user.
Coding Practices
What type of HTTP method should be used when transmitting authentication credentials?
POST
