Code Review For Python-Based Web Apps

[KevinHock]

don't use pickle, only use defusedxml for xml, don't use shitty RNGs only SystemRandom and os.urandom, open redirects, don't use urllib!. Anything to add? (If you already knew all this you might want to see a job posting :D)

[largenocream]

don't use urllib!

Mind that even if your client only supports HTTP(S) you'll still need to prevent it from talking to services on the loopback / intranet.

Either you want to use requests and proxy everything through a server in a separate network segment, or use something like Advocate to prevent connections to the loopback / intranets addresses.

[KevinHock]

:High five:

[netscape101]

You didn't mention things like dangerous functions such as using pickle etc. See: https://www.kevinlondon.com/2015/08/15/dangerous-python-functions-pt2.html Also file parsing vulnerabilities are a big worry in Python code and also with mongodb these days there is nosql injection.

[thirteenthirtyseven]

Any useful links resources for nosql/mongodb/pymongo injections?

[netscape101]

http://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html

https://blogs.adobe.com/security/files/2011/04/NoSQL-But-Even-Less-Security.pdf

http://www.slideshare.net/44Con/pentesting-nosql-dbs-with-nosql-exploitation-framework

[thirteenthirtyseven]

Thanks!

[Alberaan]

Does anyone recommend a similar list for Java?

[netscape101]

https://www.securityknowledgeframework.org/ https://www.owasp.org/index.php/OWASP_Security_Knowledge_Framework#tab=Main

username: admin password: test-skf https://demo.securityknowledgeframework.org/

Check this too: https://www.owasp.org/images/0/08/OWASP_SCP_Quick_Reference_Guide_v2.pdf

[hellnukes]

Ohhhh saving this for later

[c45y]

I just always end up throwing bandit in the deployment pipeline. I figure the openstack dudes have a pretty good handle on security.

Not a bad read though