Sent:
Sent:
``` The rule `cakephp2-view-unescaped-output` of [pieceofcake2/security-sast](https://pieceofcake2.github.io/security-sast/rules#cakephp2-view-unescaped-output) finds these places in the code. For the DOM based XSS, do not put values in the page with `innerHTML` or `document.write()` in JavaScript: use `textContent`. A Content Security Policy without `'unsafe-inline'` ([Security headers](#security-headers)) also blocks most of these scripts. ## SQL Injection A value of the request goes into SQL as it is: the attacker can read or change the database. Use the conditions arrays of `find()`, which escape the values, or the values of `query()`: ```php // Found $this->Post->query("SELECT * FROM posts WHERE title LIKE '%" . $q . "%'"); // Fixed $this->Post->find('all', ['conditions' => ['Post.title LIKE' => '%' . $q . '%']]); $this->Post->query('SELECT * FROM posts WHERE title LIKE ?', ['%' . $q . '%']); ``` pieceofcake2/security-sast finds these places with the rules [cakephp2-query-concatenation](https://pieceofcake2.github.io/security-sast/rules#cakephp2-query-concatenation) and [cakephp2-conditions-string](https://pieceofcake2.github.io/security-sast/rules#cakephp2-conditions-string). ## Paths and Files of the Request A value of the request names a file to read or include, or a view to render: `../` in it reaches other files. Map the value to a list of allowed names instead of using it as a path, and check uploaded file names with `basename()`. See the rule [cakephp2-render-request](https://pieceofcake2.github.io/security-sast/rules#cakephp2-render-request). ## Commands A value of the request goes into a command of the system (`exec()`, `shell_exec()`, `system()`, backticks): the attacker runs commands on the server. Avoid the command, or pass each value with `escapeshellarg()`. ## Redirects A value of the request is the URL of a redirect: a link of the site can send its users to another site, e.g. a copy of the login page. Redirect only to paths of the application, e.g. with a route array, or check the URL against a list. See the rule [cakephp2-redirect-request](https://pieceofcake2.github.io/security-sast/rules#cakephp2-redirect-request). ## Security Headers The headers that tell the browser to limit what a page can do: which scripts it may run (CSP), whether another site may frame it (clickjacking), whether it may guess the type of a file, and which features and cross-origin resources it may use. Set them in **one** place: - **In the web server** (recommended): every response gets them, also the files of `webroot/` and the errors of the web server. See [Web Server Settings](https://pieceofcake2.github.io/security-dast/web-server.md) for complete settings of nginx and Apache. - **In `AppController`**, when you cannot change the web server: every page of CakePHP gets them, the error pages (404, 500) too, as `CakeErrorController` extends `AppController`; the files of `webroot/` do not. ```php // src/Controller/AppController.php (app/Controller/AppController.php) public function beforeFilter() { parent::beforeFilter(); $this->response->header([ 'Content-Security-Policy' => "default-src 'self'; frame-ancestors 'self'; form-action 'self'", 'X-Frame-Options' => 'SAMEORIGIN', 'X-Content-Type-Options' => 'nosniff', 'Referrer-Policy' => 'strict-origin-when-cross-origin', 'Permissions-Policy' => 'camera=(), microphone=(), geolocation=()', 'Cross-Origin-Opener-Policy' => 'same-origin', 'Cross-Origin-Resource-Policy' => 'same-origin', ]); if ($this->request->is('ssl')) { $this->response->header('Strict-Transport-Security', 'max-age=31536000; includeSubDomains'); } } ``` Not in both: a header sent twice, e.g. two `X-Frame-Options`, is invalid for some browsers. - **CSP**: `default-src 'self'` allows the scripts, styles and images of the application only. A page with inline scripts (``, `$this->Html->scriptBlock()`, `onclick="..."`) or files of other sites needs more: move the scripts to files of `webroot/js/`, or add the sites to the policy, e.g. `script-src 'self' https://cdn.example.com`. Introduce a policy step by step: 1. Send it as `Content-Security-Policy-Report-Only`: it blocks nothing, and the console of the browser lists what it would block. 2. Go through the pages (the End-to-End tests do), and move the inline scripts and styles to files, or add the sites that the pages need. 3. Send it as `Content-Security-Policy` once the console is clean. - **Cross-Origin-Embedder-Policy** (`require-corp`) blocks the images and scripts of other sites that do not allow it. Set it only when the pages use no such resources; the alert of it is low. - **Strict-Transport-Security** only on HTTPS: a browser keeps it for `max-age` seconds, so make sure every page works on HTTPS first. ## Forms without a CSRF Token A form that changes data (`method="post"`) without a token can be sent by another site in the name of a logged-in user (CSRF). Load `SecurityComponent` in `AppController`, and build the forms with `FormHelper`: `$this->Form->create()` and `$this->Form->end()` add the token (`data[_Token][key]`), and ZAP knows this name. ```php public $components = ['Security', 'Session']; ``` ZAP reports the forms that are written in HTML (`