安全编码实用化

最佳实践：

敏感功能的审计日志
错误日志
在集中位置存储日志
在规定时间内保留日志
定期审计 PII 的日志

{
 "dependencies": {
   "foo": "1.0.0 - 2.9999.9999",
   "bar": ">=1.0.2 <2.1.2"
 }
}

import mysql.connector
db = mysql.connector.connect
#Bad Practice（不良做法）。避免这样做！
(host="localhost", user="newuser", passwd="pass", db="sample")
cur = db.cursor()
name = raw_input('Enter Name: ')
cur.execute("SELECT * FROM sample_data WHERE Name = '%s';" % name) for row in cur.fetchall(): print(row)
db.close()

ts
let url = request.params.url;

let response = http.get(url);
let render = response.render();

return render.export()；

许多框架都有一组可启用的端点，用于监控应用程序，无论是生产环境还是测试/开发环境。这些端点包括：

Metrics (Prometheus)
Logs
Environment information
Path/Url Mappings

xml
<?xml version="1.0" ?>
<!DOCTYPE outerElement [
   <!ENTITY externalEntity SYSTEM  "file:///etc/passwd" > ]>
<outerElement>&externalEntity;</outerElement>

html
<form method="POST">
     <input name="Id" type="hidden" value="666">
     <input name="Name" type="text" value="Bad guy">
     <input name="EmailAddress" type="text" value="hacker@attacker.com">
     <input name="IsAdmin" type="hidden" value="true">
     <input type="submit">
</form>  

伪
let baseFolder = "/var/www/api/documents/";
let path = baseFolder + request.params.filename;

return file.read(path)；

```html
<!--- UNSAFE: The htmlSnippet will get interpreted without any escaping --->
@Html.Raw(htmlSnippet)
```

public string UploadProfilePicture(FormFile uploadedFile)
{
    // Generate path to save the uploaded file at
    var path = $"./uploads/avatars/{request.User.Id}/{uploadedFile.FileName}";

    // Save the file
    var localFile = File.OpenWrite(path);
    localFile.Write(uploadedFile.ReadToEnd());
    localFile.Flush();
    localFile.Close();

    // Update the profile picture 
    UserProfile.UpdateUserProfilePicture(request.User, path)

    return path;
}

最常见的注入类型包括：

SQL 注入
跨站脚本（HTML/JavaScript 注入）
路径遍历（路径/Url 注入）
命令注入
代码注入

cs

// Ensure the default behaviour is to authenticate requests, and check if they are admin
[Authenticate]
[Authorize("Admin")]
public class SecureController : Controller
{

}

public class MyController : SecureController
{

    // Overrides the Authorize attribute inherited to allow any user to access the page

let ip = request.params.ipAddress;

system("ping " + ip)；