From the file system to web services, permissions allow an owner of a resource to determine who has access to what within their domain. Today we’re going to talk about the former which is file system access control. We’ve been filing a number of bugs recently that are related to permissions during our pro-bono campaign to help shore up issues across multiple blockchain projects.
But what exactly is the problem?
Many code bases work with files, it’s a common thing to do. Opening them to read configuration, writing out logs, deleting stuff that’s no longer needed on cleanup, etc. The…
Injection attack can manifest themselves in many different ways within your application. You’ve probably heard stories of SQL injection, a far too common issue in web applications or RCE (Remote Code Execution), which actually refers to memory corruption and executing arbitrary code, but often is used generically to mean “execution of arbitrary stuff, either code or commands” and is often the result of Command injection. Wherever there’s an opportunity to mix input into a query, command, of otherwise statement for a particular format or protocol, along with something to gain from changing the processes intended behavior, there’s risk of injection.
…
Just a quick clarification to make as these should really be called “Bug Weeksly” as we probably won’t be pushing them out every single week, but every couple to few weeks to maintain quality content. But as Weeksly doesn’t quite roll of the tongue (and further isn’t even a real word), we’ll keep it titled the way it is with this caveat in mind.
Now, onto this week’s bug and a common, yet subtle mistake programmers make when copying memory from one spot to another: using the incorrect size. This one comes from C/C++ land, although it may manifest itself…
If your code uses libraries that you didn’t write and you don’t own, you inherit that code’s risks. It’s bugs become your bugs. You have extended your attack surface from what it was to what it is now with these new additional lines.
You know the other day when you needed the site to generate a pdf, so you googled with “php pdf library” and found one that looked good, downloaded it and started using it. Problem solved! That was fun, right?
Or when you were working on the backend server and thought, “it would be great if we could…
Here at Block Audit, we’re all about finding and fixing those security bugs. They can often crop up in the oddest places and knowing which components of your application are the most risky can lead to some rather important, yet unexpected discoveries (or expected discoveries in the case of an professional bug hunter :).
Anyways, we thought highlighting some of the more common, yet interesting classes of issues would be fun and not only show folks we know our stuff, but enlighten a few developers around the world in the meantime. Security isn’t on by default for most all coding…
Block Audit
Is your product secure?
