Download to read offline
![Add your own validator
define([
'jquery',
'jquery/ui',
'jquery/validate',
'mage/translate'
], function ($) {
$.validator.addMethod('validate-custom-name',
function (value) {
return (value !== 'anna');
}, $.mage.__('Enter valid name'));
});
M
2](https://image.slidesharecdn.com/magetitans-secureinputandoutputhandling-161114060836/85/Secure-input-and-output-handling-Mage-Titans-Manchester-2016-28-320.jpg)
Uploaded byAnna Völkl
Secure input and output handling - Mage Titans Manchester 2016
This document is a presentation by Anna about Magento security, focusing on cross-site scripting (XSS) vulnerabilities and best practices for frontend and backend input validation. It emphasizes the importance of not trusting user input and implementing multiple layers of security, including client-side validation and output escaping. The presentation also discusses Magento’s built-in validation rules and methods to enhance security against XSS attacks.
![Magento Application Security [EN]](https://cdn.slidesharecdn.com/ss_thumbnails/magentoapplicationsecurityenmm15nl-150529123031-lva1-app6891-thumbnail.jpg?width=640&height=640&fit=bounds)
Secure input and output handling - Mage Titans Manchester 2016
- 2. Hi, I’m Anna! Ido Magento things 6 years of Magento, PHP since 2004 I love IT & Information Security Magento Security Best Practises, anyone?! I work at E-CONOMIX Magento & Typo3 ❤ Linz, Austria
- 3. What this talkis all about: ★ Cross-Site Scripting (XSS) ★ Frontend input validation ★ Backend input validation ★ Output escaping
- 4.
- 5. Academic titles -what we expected BA PhD BSc MA DI MSc Mag. MBA Dr. LL.M.
- 6. Academic titles -what we got
- 7.
- 8.
- 9.
- 10.
- 11. “XSS flaws occurwhenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.” Source: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
- 12. 65% of all websitesglobally suffer from XSS Source: http://security.stackexchange.com/questions/129447/why-does-xss-affect-so-many-websites
- 13. XSS in latestSUPEEs SUPEE-7405 ● 20 vulnerabilities ● 7 XSS (2 critical, 1 high, 2 medium, 2 low) SUPEE-8788 ● 17 vulnerabilities ● 4 XSS (1 high, 4 medium)
- 14. Every feature addsa risk. ⬇ Every input/output adds a risk.
- 15.
- 16.
- 17.
- 18.
- 19. Security-Technology, Department ofDefense Computer Security Initiative, 1980
- 20. Stop “Last MinuteSecurity” Do the coding, spend last X hours on „making it secure“ Secure coding doesn't really take longer Data quality ⇔ software quality ⇔ security Always keep security in mind.
- 21.
- 22.
- 23. Frontend input validation Userexperience Stop unwanted input when it occurs Do not bother your server with crazy input requests Don't fill up your database with garbage.
- 24. Magento Frontend Validation Magento1 (51 validation rules) js/prototype/validation.js Magento 2 (74 validation rules) app/code/Magento/Ui/view/base/web/js/lib/ validation/rules.js
- 25.
- 26.
- 27.
- 28. Add your ownvalidator define([ 'jquery', 'jquery/ui', 'jquery/validate', 'mage/translate' ], function ($) { $.validator.addMethod('validate-custom-name', function (value) { return (value !== 'anna'); }, $.mage.__('Enter valid name')); }); M 2
- 29. <form> <div class="field required"> <inputtype="email" id="email_address" data-validate="{required:true, 'validate-email':true}" aria-required="true"> </div> </form> Adding frontend-validation M 2
- 30.
- 31. <form> <div class="field required"> <inputtype="email" id="email_address" data-validate="{required:true, 'validate-email':true}" aria-required="true"> </div> </form> Adding frontend-validation M 2
- 32. Source: https://quadhead.de/cola-hack-sicherheitsluecke-auf-meinecoke-de/ Why frontendvalidation is not enough...
- 33. Don’t trust theuser. Don’t trust the input!
- 35. EAV Backend validationinput rules Magento 1 Mage_Eav_Attribute_Data_Abstract Magento 2 MagentoEavModelAttributeDataAbstractData
- 36. MagentoEavModelAttributeDataAbstractData Input Validation Rules: alphanumeric- numeric - alpha - email - url - date M 2
- 37. ZendValidator Standard Validation Classes AlnumValidator Alpha Validator Barcode Validator Between Validator Callback Validator CreditCard Validator Date Validator DbRecordExists and DbNoRecordExists Validators Digits Validator EmailAddress Validator File Validation Classes GreaterThan Validator Hex Validator Hostname Validator Iban Validator Identical Validator InArray Validator Ip Validator Isbn Validator IsFloat IsInt LessThan Validator NotEmpty Validator PostCode Validator Regex Validator Sitemap Validators Step Validator StringLength Validator Timezone Validator Uri Validator
- 38.
- 39. Is input validationnot enough?!
- 40. Magento 2 Templates XSSsecurity
- 41. getXXXHtml() <?php echo $block->getTitleHtml()?> <?php echo $block->getHtmlTitle() ?> <?php echo $block->escapeHtml($block->getTitle()) ?> M 2 Magento 2 Templates XSS security
- 42. Type casting andPHP function count() <h1><?php echo (int)$block->getId() ?></h1> <?php echo count($var); ?> M 2 Magento 2 Templates XSS security
- 43. Output in singleor double quotes <?php echo 'some text' ?> <?php echo "some text" ?> M 2 Magento 2 Templates XSS security
- 44. Use specific escapefunctions <a href="<?php echo $block->escapeXssInUrl( $block->getUrl()) ?>"> <?php echo $block->getAnchorTextHtml() ?> </a> M 2 Magento 2 Templates XSS security
- 45. Use these. AlsoMagento does it! $block->escapeHtml() $block->escapeQuote() $block->escapeXssInUrl() M 2
- 46. $block->escapeHtml() String output thatshould not contain HTML M 2
- 47. MagentoFrameworkEscaper /** * Escape stringfor HTML context. allowedTags will not be escaped, except the following: script, img, embed, * iframe, video, source, object, audio * * @param string|array $data * @param array|null $allowedTags * @return string|array */ public function escapeHtml($data, $allowedTags = null) { ... ... }
- 48. $block->escapeHtml() String output thatshould not contain HTML $block->escapeXssInUrl() ⇒ $block->escapeUrl() URL output $block->escapeQuote() Escape quotes inside html attributes M 2
- 50.
- 51. Static XSS Test XssPhtmlTemplateTest.phpin devtestsstatictestsuiteMagentoTestPhp See http://devdocs.magento.com/guides/v2.0/frontend-dev -guide/templates/template-security.html
- 52. $ magento dev:tests:runstatic
- 53. $ magento dev:tests:runstatic
- 54. What happened tothe little attribute?!
- 55. Weird customers andcustomer data was removed Frontend validation added - Dropdown (whitelist) would have been an option too Server side validation added Output escaped
- 56. Summary Think, act anddesign your software responsibly: 1. Client side validation 2. Server side validation 3. UTF-8 all the way 4. Escape at point of use 5. Use & run tests
- 57. Questions? Right here, rightnow or later @rescueAnn Thank you! ❤