# Security Basic Notes ## Curated List of Vulnerability ### Object Injection - `__proto__.XX` - `constructor` - `hasOwnProperty` #### Insecure Object Comparison injection: ```js const token = req.cookies.token; // vulnerability: // SESSIONS[constructor] => `true` if (token && SESSIONS[token]) { next(); } ``` solutions: - `crypto.timingSafeEqual` - `object.hasOwnProperty(token)` ### SQL Injection user input: ' or 1=1-- ```sql SELECT * FROM users WHERE email = 'user@email.com' AND pass = '' or 1=1--' LIMIT 1 ``` #### SQL Injection Protection - Don’t allow multiple statements. - Validate user input. - Allowlist user input. - Parameterized statements: use placeholders instead of variable interpolation. ```sql -- Construct the SQL statement we want to run, specifying the parameter. String sql = "SELECT * FROM users WHERE email = ?"; ``` ### Click Jacking Hover a transparent malicious link upon the true button #### Click Jacking Protection - frame killing snippet ```html ``` - X-Frame-Options ```js // nodejs response.setHeader('X-Frame-Options', 'DENY'); response.setHeader('Content-Security-Policy', "frame-ancestors 'none'"); ``` ### Session Fixation #### Protection 在 **HTTP Cookies** 中传输**复杂**的 Session IDs, 并在**成功连接**/**恶意篡改**后重置 Session IDs. - where: not passing session IDs in queryStrings/requestBody, instead of passing them in **HTTP cookies** ```js req.session.regenerate(function (err) { process(err); }); ``` - what: generate complex session IDs ```js const generateSessionId = session => uid(24); ``` - how: reset session IDs after set up session successfully - how: reset session IDs after it's been changed manually on client(Set-Cookies) ### XSS Attack Cross-Site Scripting: - Reflected XSS: url input (search pages) `http://localhost:8080/test?name=`. - Stored XSS: store script into database. user input: `` #### XSS Protection don't trust user: - `replace(/