In this session, I'll show the most common vulnerabilities that our Drupal code can have and how we should be prepared to avoid such an insecure code to be released. The presentation covers trends in vulnerabilities, starting in general aspects then showing Drupal specific ones. I'll also speak about what we should do if we find any vulnerabilities in contributed solutions. All backgrounds are welcome from Drupal site builders to contributed projects' maintainers! Every one of you will be able to learn and improve your security awareness as being an active participant in the session. Be ready for some showcases where we'll check Drupal 7 and 8 codes that are vulnerable and will fix them in live! https://drupalcampkyiv.org/node/27

1. LET’S WRITE SECURE DRUPAL
CODE!
TATAR BALAZS JANOS
DRUPALCAMP KYIV
KYIV, UKRAINE – 25.05.2019
DRUPALCAMP
KYIV’19

2. Who am I?
Tatar Balazs Janos
@tatarbj
Works with Drupal since 2007
CTO @ Petend
Drupal Security Correspondent @ EC
Active mentor @ Mentoring community group
Provisional member @ Drupal Security Team
SecOSdreamer @ Secure Open Source day
DRUPALCAMP
KYIV’19

3. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

4. Are there site builders?
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

5. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

6. Demo
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

7. Gist
https://gist.github.com/tatarbj/c73e452fe208f4281af09c110a63b9bd
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

8. Are there developers/maintainers?
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

9. Have you attended on a previous Let’s
write secure Drupal code! session?
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

10. DrupalCamp Antwerp 2017
DrupalCamp Ruhr 2018
DrupalDevDays 2018
Drupal Europe 2018
DrupalCamp Oslo 2018
DrupalCamp London 2019
Drupal Mountain Camp 2019
DrupalCamp Spain 2019
DrupalCamp Belarus 2019
DrupalCamp Kyiv 2019 – 10th edition!
History
DRUPALCAMP
KYIV’19 Tatar Balazs Janos - @tatarbj

11. Trends in Security
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

12. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

13. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

14. Types of vulnerabilities
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

15. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

16. Cross Site Scripting
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

17. Client side vulnerability
Unfiltered output
Never trust any user input.
We’ve seen the demo before ;)
Cross Site Scripting
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

18. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

19. Html::escape() – plain text
Xss::filter() – html is allowed
Xss::filterAdmin() – text by admins
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

20. Bingo
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

21. Everyone has a bingo card (check your bag!)
If you answer well, mark the number!
Wrong answer = no number!
First who shouts BINGO! wins the price!
Rules and etiquette
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

22. Round 1
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

23. function custom_field_formatter_view(...) {
foreach ($items as $key => $value) {
//...
$element[$key] = array(
'#type' => 'markup',
'#markup' => t('<img src="!src" alt="@alt" />',
array('!src' => $value['src'], ‚$alt’ => $value['alt'])),
);
//...
}
return $element;
}
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

24. function custom_field_formatter_view(...) {
foreach ($items as $key => $value) {
//...
$element[$key] = array(
'#type' => 'markup',
'#markup' => t('<img src="!src" alt="@alt" />',
array('!src' => $value['src'], ‚$alt’ => $value['alt'])),
);
//...
}
return $element;
}
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

25. function custom_field_formatter_view(...) {
foreach ($items as $key => $value) {
//...
$element[$key] = array(
'#type' => 'markup',
'#markup' => t('<img src="@src" alt="@alt" />',
array('@src' => $value['src'], ‚$alt’ => $value['alt'])),
);
//...
}
return $element;
}
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

26. 12
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

27. <?php print '<a href="/' . check_url($url) . '">'; ?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

28. <?php print '<a href="/' . check_url($url) . '">'; ?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

29. 4
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

30. foreach ($items as $delta => $item) {
$id = $item->getValue()['target_id'];
$content = Drupal::entityTypeManager()
->getStorage($entity_type_id)
->load($id);
$body = $content->get('body_field')->getValue()[0]['value'];
}
$elements[$delta] = array(
'#theme' => 'something_custom',
'#body' => $body,
);
return $elements;
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

31. foreach ($items as $delta => $item) {
$id = $item->getValue()['target_id'];
$content = Drupal::entityTypeManager()
->getStorage($entity_type_id)
->load($id);
$body = $content->get('body_field')->getValue()[0]['value'];
}
$elements[$delta] = array(
'#theme' => 'something_custom',
'#body' => $body,
);
return $elements;
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

32. foreach ($items as $delta => $item) {
$id = $item->getValue()['target_id'];
$content = Drupal::entityTypeManager()
->getStorage($entity_type_id)
->load($id);
$body = [
'#type' => 'processed_text',
'#text' => $content->get('body_field')->getValue()[0]['value'],
'#format' => $content->get('body_field')->getValue()[0]['format'], ];
}
$elements[$delta] = array(
'#theme' => 'something_custom',
'#body' => $body,
);
return $elements;
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

33. 23
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

34. Drupal 8 allows Full HTML to be used
by anonymous users.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

35. Drupal 8 allows Full HTML to be used
by anonymous users.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

36. Drupal 8 allows Full HTML to be used
by authenticated and administrator
users.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

37. 17
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

38. User input must be always sanitized.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

39. User input must be always sanitized.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

40. 25
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

41. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

42. Use behat/automated tests.
<script>alert('XSS')</script>
<img src="a" onerror="alert('title')">
Check your filters and user roles.
Do not give too many options to untrusted users!
Protection against Cross Site Scripting
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

43. Access Bypass
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

44. User can access/do something.
Menu items can be defined to be
accessed/denied.
Many access systems: node, entity, field, views...
Access bypass
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

45. Round 2
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

46. <?php
$query = db_select('node', 'n')
->fields('n', array('title', 'nid'))
->condition('type', 'article');
$result = $query->execute();
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

47. <?php
$query = db_select('node', 'n')
->fields('n', array('title', 'nid'))
->condition('type', 'article');
$result = $query->execute();
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

48. <?php
$query = db_select('node', 'n')
->fields('n', array('title', 'nid')
->condition('type', 'article')
->addTag('node_access');
$result = $query->execute();
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

49. 29
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

50. mymodule.not_found:
path: '/not-found'
defaults:
_controller: DrupalmymoduleControllerNotFoundController::build404
_title: 'Page not found'
requirements:
_access: 'TRUE'
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

51. mymodule.not_found:
path: '/not-found'
defaults:
_controller: DrupalmymoduleControllerNotFoundController::build404
_title: 'Page not found'
requirements:
_access: 'TRUE'
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

52. 16
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

53. All users on Drupal sites belong to at
least 2 user role.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

54. All users on Drupal sites belong to at
least 2 user role.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

55. All users on Drupal sites belong to at
least 1 user role.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

56. 22
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

57. Restricted permissions make Drupal
sites more secure by calling
restrict_permission() method.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

58. Restricted permissions make Drupal
sites more secure by calling
restrict_permission() method.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

59. Restricted permissions make Drupal
sites more secure by raising
attention on the permission page.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

60. 6
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

61. Drupal 8 allows users to mistype
their passwords unlimited times.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

62. Drupal 8 allows users to mistype
their passwords unlimited times.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

63. Drupal 8 allows users to mistype
their passwords 5 times.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

64. 9
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

65. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

66. Visit node/nid and other urls
Visit anything/%node
Use behat/automated tests.
node_access, entity_access
Menu definitions
user_access for permissions
$query->addTag('node_access')
Protection against Access bypass
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

67. SQL Injection
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

68. Unauthorized access to database resources.
Do not trust any user input.
SA-CORE-2014-005 – Highly critical D7 SA
SQL Injection
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

69. Round 3
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

70. <?php
$result = Drupal::database()
->delete('people')
->condition('name', '%_' . $_GET['param'], 'LIKE');
->execute();
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

71. <?php
$result = Drupal::database()
->delete('people')
->condition('name', '%_' . $_GET['param'], 'LIKE');
->execute();
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

72. <?php
$database = Drupal::database();
$result = $database
->delete('people')
->condition('name', $database->escapeLike($_GET['param']), 'LIKE');
->execute();
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

73. 31
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

74. A highly critical Drupal 8 core update
remediated an SQL injection
vulnerability in 2014.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

75. A highly critical Drupal 8 core update
remediated an SQL injection
vulnerability in 2014.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

76. A highly critical Drupal 7 core update
remediated an SQL injection
vulnerability in 2014.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

77. 15
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

78. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

79. Use always drupal Database API!
db_query with :placeholder (deprecated in D8,
in D9 will be removed)
Filter parameters
Check the queries in code.
username' AND 1=1
POST requests by curl
Protection against SQL Injection
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

80. Round 4
Ready for some other code?
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

81. <?php
function _generate_password($length = 8) {
$pass = ’’;
for ($i = 0; $i < $length; $i++) {
// Each iteration, pick a random character from the
// allowable string and append it to the password:
$pass .= $allowable_characters[mt_rand(0, $len)];
}
}
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

82. <?php
function _generate_password($length = 8) {
$pass = ’’;
for ($i = 0; $i < $length; $i++) {
// Each iteration, pick a random character from the
// allowable string and append it to the password:
$pass .= $allowable_characters[mt_rand(0, $len)];
}
}
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

83. <?php
function _generate_password($length = 8) {
$pass = ’’;
for ($i = 0; $i < $length; $i++) {
do {
// Find a secure random number within the range needed.
$index = ord(drupal_random_bytes(1));
} while ($index > $len);
$pass .= $allowable_characters[$index];
}
}
?>
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

84. 8
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

85. // custom_module.permissions.yml
administer custom module:
title: 'Bypass access control'
description: 'Allows a user to bypass access control.’
// custom_module.routing.yml
custom_module.settings.form:
path: '/admin/config/custom/settings'
requirements:
_permission: 'administer custom module'
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

86. // custom_module.permissions.yml
administer custom module:
title: 'Bypass access control'
description: 'Allows a user to bypass access control.’
// custom_module.routing.yml
custom_module.settings.form:
path: '/admin/config/custom/settings'
requirements:
_permission: 'administer custom module'
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

87. // custom_module.permissions.yml
administer custom module:
title: 'Bypass access control'
description: 'Allows a user to bypass access control.’
restrict access: TRUE
// custom_module.routing.yml
custom_module.settings.form:
path: '/admin/config/custom/settings'
requirements:
_permission: 'administer custom module'
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

88. 20
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

89. // contrib_module.routing.yml
contrib_module.settings.form:
path: '/admin/config/contrib/settings'
requirements:
_permission: 'administer site configuration'
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

90. // contrib_module.routing.yml
contrib_module.settings.form:
path: '/admin/config/contrib/settings'
requirements:
_permission: 'administer site configuration'
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

91. 26
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

92. OWASP stands for Online Web
Authentication Super Project.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

93. OWASP stands for Online Web
Authentication Super Project.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

94. OWASP stands for Open Web
Application Security Project.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

95. 10
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

96. XXE stands for XML External
Entities vulnerability.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

97. XXE stands for XML External
Entities vulnerability.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

98. 32
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

99. SQL Injection is a server side
vulnerability.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

100. SQL Injection is a server side
vulnerability.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

101. 13
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

102. Cross Site Request Forgery
vulnerability is in the TOP10 of
OWASP list from 2017.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

103. Cross Site Request Forgery
vulnerability is in the TOP10 of
OWASP list from 2017.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

104. Cross Site Request Forgery
vulnerability is not in the TOP10 of
OWASP list from 2017, but was in 2013.
Tatar Balazs Janos - @tatarbj
?
DRUPALCAMP
KYIV’19

105. 5
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

106. In case of no winner,
extra numbers are coming!
Tatar Balazs Janos - @tatarbj
!
DRUPALCAMP
KYIV’19

107. 18
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

108. 27
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

109. 30
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

110. 1
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

111. 11
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

112. 33
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

113. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

114. Security Improvements
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

115. *https://events.drupal.org/sites/default/files/slides/pwolanin-2017-09-ways-drupal8-d.pdf
Many ways Drupal 8 is more secure!*
Twig templates for HTML generation
Removed PHP format
Site configuration exportable, versionable
User content entry and filtering improvements
User session and session always in ID handling
Automated CSRF token protection
Trusted host patterns enforced for requests
Single statement execution for SQL
Clickjacking protection
Content security policy compatibility with Core Javascript API
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

116. Learn by Advisories
Tatar Balazs Janos - @tatarbj

117. Security advisories are for
 Only stable modules
 No alpha, beta, dev
 d.org hosted projects
@Maintainers: If you are contacted, be supportive! 
Drupal Security Team
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

118. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

119. Hacked!
Security review (simplytest.me)
Password policy
Encrypt
Composer Security Checker
Permission report
Drop Guard
Security Awareness programs
+ PHPCS Drupal BestPractice Sniff
Security related projects
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

120. Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

121. SecOSdays
25-26 OCTOBER, 2019 - SOFIA, BULGARIA
Call For Sessions and Sponsors are open!
DRUPALCAMP
KYIV’19

122. Questions?
Tatar Balazs Janos - @tatarbj
DRUPALCAMP
KYIV’19

123. Tatar Balazs Janos
@tatarbj
Thank you!
DRUPALCAMP
KYIV’19