Building secure web application - my two pennies

I recently ran into discussion about PHP application security. The main question was:

Can anyone tell what security issues should I consider to make it (a PHP+MySQL+Ext JS application) a secure application.

My first tough was to send a link to Owasp TOP-10. But that would not be enough - If one needs to ask such broad question on Linked In then he/she is not ready to make a secure web application. Making a web application secure is not a topic that can be inclusively answered with a single forum- (nor blog)-post. There are quite meny books written on the subject.

But never the less i'll try to give my contribution on the matter and write down few (as simple as possible) rules that anyone even considering making a web application should obey.

Treat every request as it came from your worst enemy

... and it is trying to break your application. Validate every single input of the request before using it anywhere. If possible, build your software in a way that you cannot bypass the validation in your code even if you wanted to. If some input needs to accept pretty much everything then make a rule that says "pretty much everything allowed" - this shows that you have even thought about input sanitation. Finding the right balance between too tight and loose validation rules is the hard part. Owasp TOP-1 - Injection.

Escape every single output

... as close to the actual outputting as possible. It doesn't really matter where the input came from - GET-parameter, a form the user just posted, database or some exotic setting file. It might have been compromised and if it has, you do not want output it in a way that it would be executed in users browser. Because that is the way to Owasp TOP-2 - Cross-Site Scripting.

Do not let anyone access any restricted data

... unless they're specifically allowed to do so. Whenever anyone asks for any non-public data, check that the user has rights to access it. And if not, the safest way to handle the situation is to give a 404. This way you don't tell that the object tried to access actually exists - but the user doesn't have rights to access it. Owasp TOP-4 - Insecure Direct Object References.

Use random tokens to every state-changing request

... to make sure that the request came from your UI - not some malicious site the logged in user happens to be browsing. Simply put: store a random string to session-data and when the application receives request to state-changing action, make sure that it is the same that you have stored in session. The token doesn't need to be unique for every request, but it needs to be unique for that session. When encountering missing or inaccurate token the failed request should be logged as it might be Owasp TOP-5 - Cross-Site Request Forgery. Also reset the session token - cannot brute-force something that is constantly changing, can you?

Do not take any redirect parameters directly from the URL

... because those do not belong there! If you do then anyone can make a link that starts with your domain but lands somewhere totally different - like their phishing site that looks exactly the same as yours. And *puf* the hackers now have valid credentials to your application. Owasp TOP-10 - Unvalidated Redirects and Forwards.

And by mother of a supernatural intelligence:

Never ever store the passwords in plain text!

I hope that I don't need to tell you why.

Wind of change

Totally dumping current CSS-library - Goodbye Blueprint, welcome Bootsrap! Main reason is possibly Bootsrapts support for responsive desing.

I've changed the CSS-library, that is all about everything I have managed to do. Last month has been quite eventfull. Went to London 2012 paralympics to support Finnish goalball team. The woman came fourth and the men wom gold! Considering how small country Finland is our six medals (4 golds, a silver and a bronze) is good result. But that's enought about sports.

New responsive layout is working great. Bootstrap has great documentation and examples to learn from. The minus side is that I just copy what others have done, do some minor adjustments but have no idea how it actually work. What are the CSS definitions that do the magic? Whitout that knowledge I will always be depending on someone elses code. But for now it will have to do. My spear time is so rare that I have to priorize - and the family comes first.

This post is quite stub, but what can I do when there hasn't been any progress in Cimbic or JSFramework besides the Bootstrap.

Over and out!

Roadmap of Cimbic

Things have moved forward sinse my last blog. Not mutch but still. From a blog by J.Boye I formed the roadmap of Cimbic. Some of the features had already been implemented, others are on the way.
Cimbic roadmap is:

1) Separation of content and presentation - DONE
2) Rich text editing
3) Access control lists 
 - E.g restricting who can view/edit certain areas 
4) Automatic handling of change in navigation / site structure 
5) Short, meaningful, friendly URLs 
 - without file extensions (e.g. .aspx) - DONE 
 - and extremely short URLs 
6) Automatic content import 
 - Eg. RSS / XML feeds 
7) Multi-delivery to different platforms 
 - Including mobile and printer-friendly 
8) Multi-lingual
 - At least western European charset / UTF8
 - Some way to handle sites in multiple languages
9) Broken links checker

Latest improvements to Cimbic are page and site specific settings stored in .json-files. I chose that format because it can present quite complex hierarchy and deconding and encoding is trivial with native php.

Currently I'm implementing point 2 on roadmap - content editing with Create.js. It has quite many dependencies: jQuery, jQuery UI, Underscore, Backbone, VIE, the editor of my choise - hallo.js
One problem I encountered was providing Cimbics static files (CSS/JS/image) when the Public-folder of site not located under Cimbic. Site starts an instance of Cimbic given the physical location of the sites folder on server and then Cimbic would handel the rest. First solution was to refere those files via Controller/method, like StaticFile/css/name/of/file. This worked and I was able to provide static files stored under Cimbic to any site using it and it was quite easy.

But there was one huge but. Providing images refered in 3rd party CSS (and/or JavaScript) is no longer trivial. I do not want to change every reference to images on the CSS/JS files so that I could provide them by Cimbic. And because Cimbics CSS/JS/image files are not responsibility of the Site using Cimbic and therefore those files shouldn't be stored under Site. But the Public folder IS under Site and there's the problem. I don't want to change the hiearchy so that Public folder is under Cimbic and it determinates what Site to present.

My solution was to make install-script that copies or creates symbolic link(s) from Sites public folder to Cimbics relevant folder(s). This way Cimbic would hold it own CSS/JS/image files but they can be refered from Sites public folder. Future step would be to create new blank site with same or similar script. I haven't actually done the script yet - haven't even desided between shell- and php-script.

I also have given step 7 of roadmap some thought. Being quite active iPad user I think that the Sites using Cimbic should use responsive layout to support mobile devices. So I'm studying the matter from Net Magazine and Design Shack. The goal is to provide responsive layout for Sites by with just few class definitions to template divs. We'll see how that goes…

'Till the next time: Keep on coding!

Something usefull - at last

Couple of weeks ago I had serious doubts about continuing my CMS, after seeing this video.

I thought why should I make CMS when so many other already done it much better than I ever could.
But then I realized that thinking that way is like thinking "Why should I go for a run, when there is always someone who runs faster". Building CMS is not a composition, at least - not for me.

I'we bumped into some interesting articles recently, like What's the least You can expect from a modern CMS. That is a quite good list of things to do in my CMS. Not all at once, but little by little.

As I told earlier I renamed by CMS to Cimbic. There has been progress with the system, new GitHub repository, redone namespacing (for the 3rd time), now I will follow PSR–2 conding conventions. Although I don't totally agree with all of the rules, following that style guide will produce clean, easy-to read code.

The Cimbic will not use any database to store the content. At this point I'we managed to get Cimbic to provide static .htm files with free hierarchy. The content is wrapped in html generated from Dwoo templates. If the requested content doesn't exist, Cimbic will show custom 404-page. First time since I started the project and this blog I actually have something someone could use as base for their web-page.

Cimbic hierarchy in a nutshell:

  somesite.net –launches–> Cimbic –extends–> JSFramework

Aim is that the site (somesite.net) has as little business logic as possible, only php-script at the moment is Public/index.php - used only for launching Cimbic-instance.

Now that I got the displaying of content to work, the next steps (after I get the tests to work again…) is to implement editing of the content, session management and so on. I'm going to try using Create.js for editing content. Their demo is SO cool! Definitly something I want my CMS to have - simply elegant.

I'll put the CMS live to my homepage in progress. And as always, I will share everything on GitHub, possibly be the most important social network in existence.

Keep on coding!

New parameter besides POST and GET

"Comment Your code. Do the tests first. This forces You to think WTF it is that You're doing."

This is how I commented my friend when he said that he had wrote code that he doesn't know that the f*k it does, but it works. You don't do anything with code if You don't know what it does. Would You agree?

The bug I had earlier in my framework about mixing traditional and this custom way of GET-parameters fails - has been fixed. But if I give parameters in URI like this:

/YourController/itsMethod/someParam:value/fuu:bar/

and interpret it as request for controller "YourController"s method "itsMethod" and parameters "someParam" = "value" and "fuu" = "bar", then the parameters are not GET-parameters. Those would be given like: "?someParam=value&fuu=bar".

But what are they? I think I need to give them some sort of name.

Naming stuff is hard. I want to give describing name that actually means something but doesn't have risk to be confuced with something else. Name "URI" would confuce to beleave that it's the whole "Uniform resource identifier". The usage of these parameters would be to refer to certain ID:s, for example like:

/User/view/id:145/ or /Page/show/pid:37/

But naming the parameter just "ID" would not tell the whole story. And concider the code $_ID['id']… Don't like it. But how about "UNIQ", short from "unique". $_UNIQ['id'] is much more like it. Let's think the URI again for second, code $_URI['id'] could be read like "part 'id' from 'URI'" - but that is exactly what it is. No matter if one would use it as something else than identifier, the concept would still be correct. URI "/User/list/start:15/limit:50/" would have parts "start" and "limit".

It is desided then: In my framework there shall be three kind of parameters, GET-, POST- and URI-parameters.

---

And more about naming stuff. I previously named my framework "JSFramework". Well, it has obvious risk being confused as JavaScript framework when it in fact is a PHP framework. A colleague of mine wrote that writing my own framework rather than using existing "proves my hubris". After googling I found out that hubris meas extreme pride and arrogance. Being one of the three virtues of a programmer, I take it as compliment.

In Finland we have this saing "Siitä se ajatus sitten lähti", roughly "That's where the idea began". How does Hubris Framework sound like?

And the CMS? To be honest, would You use content management system named "Keijo" (traditional finnish male name). Today I came up with another name: "Cimbic". "Cms I Made Because I Can". It also appears to be a name - apperently lastname and name of a company. But I doupth naming my CMS that would in any way be a problem.

- Joona

Couple of all-nighters

Quite tired right now... Haven't got much sleep recently, but quite a lot of code and tests.

At the start I kind of dumped Zend Framework. I don't know hot it works and I want to know how the code I use works. So made my own framework, at least version 0.0.1.

So now I have two projects going on at the same time, Framework (JSFramework) and CMS (keijoCM). I'll try to put everything CMS specific into the CMS and other, re-usable stuff into the Framework.

I got the code coverage of Unit tests of JSFramework to about 73 %, target being 100 %. I ran into multiple unit testing related problems like how to mock PHP's native functions or mysqli-object, or how to mock a class wich is used inside the class under test. For example creating a new View-object in Controller's init() method. When testing the class Controller, I don't want to test/use the class View at all. If I made a stub of the class, I would get the same error as below.

Yet another problem with the tests was stub-classes when generating code coverage report. I made "wrapper" class for some native functions so I could mock those, for example the header() function. I don't want the class under test to put actual headers (will throw error), so I wrapped it to NativeFunctions::header(). And for the test I rewrote the NativeFuctions so that header() would just return "true". Everything went ok, tests run, all green but when the PHPUnit starts making code coverage report I got PHP Fatal about redeclaring NativeFunctions-class. The only doable solution I found was to exclude the NativeFunctions from the code coverage report with:


    <filter>
        <whitelist>
            <directory suffix=".php">../Source</directory>
            <exclude>
                <file>../Source/NativeFunctions.php</file>
                <file>../Source/autoloader.php</file>
            </exclude>
        </whitelist>
    </filter>


But I got the JSFramework somewhat tested and started the keijoCM today. Basically what it does at the moment is determinate from the url what controller and method to use and parses extra GET-parameters from url. Normally parameters are given like "...?name=value&another=somethingElse", but keijoCM accepts like ".../name:value/another:somethingElse" and can be (as far as I know) then indexed by search engines (for example Google).

Great... now I found a bug... If You mix those two ways, the url parsing doesn't work as expected. Well, next steps are to create a test that catches the bug and then eliminate it. Search and destroy.

And so it begins

My first blog text - ever.

This week I applied for membership for Kapsi internet-käyttäjät ry, who gave me little bit homepage space and a mysql database at my disposal. Now I'll start making my own homepage. Not the first one, but it'll be best one so far.

Someone ones told me that every programmer should make their own content management system. So that's what I'll do. I first thought of making my own framework for it too, but no. I'll use Zend Framework - which I've never used before - in order to lear it, in case i bump into it later on.

Some requirements that I set for the upcoming CMS:
* MVC architect
* Pages must have hierarchy and that hierarchy can be changed
* "Easy to use" - rather abstract requirement, but I'll give a thought to the user interface
* Theme-able - well just see how easy that'll be... I might use Smarty
* Open source - I will put all code on GitHub

We will see how much time I'm going to have on this. Being a working family man one doesn't have too much free time. But everyone should have a hobby, right?