Download to read offline
![function custom_field_formatter_view(...) { foreach ($items as $key => $value) { //... $element[$key] = array( '#type' => 'markup', '#markup' => t('<img src="!src" alt="@alt" />', array('!src' => $value['src'], ‚$alt’ => $value['alt'])), ); //... } return $element; } Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-23-2048.jpg)
![function custom_field_formatter_view(...) { foreach ($items as $key => $value) { //... $element[$key] = array( '#type' => 'markup', '#markup' => t('<img src="!src" alt="@alt" />', array('!src' => $value['src'], ‚$alt’ => $value['alt'])), ); //... } return $element; } Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-24-2048.jpg)
![function custom_field_formatter_view(...) { foreach ($items as $key => $value) { //... $element[$key] = array( '#type' => 'markup', '#markup' => t('<img src="@src" alt="@alt" />', array('@src' => $value['src'], ‚$alt’ => $value['alt'])), ); //... } return $element; } Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-25-2048.jpg)
![foreach ($items as $delta => $item) { $id = $item->getValue()['target_id']; $content = Drupal::entityTypeManager() ->getStorage($entity_type_id) ->load($id); $body = $content->get('body_field')->getValue()[0]['value']; } $elements[$delta] = array( '#theme' => 'something_custom', '#body' => $body, ); return $elements; Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-27-2048.jpg)
![foreach ($items as $delta => $item) { $id = $item->getValue()['target_id']; $content = Drupal::entityTypeManager() ->getStorage($entity_type_id) ->load($id); $body = $content->get('body_field')->getValue()[0]['value']; } $elements[$delta] = array( '#theme' => 'something_custom', '#body' => $body, ); return $elements; Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-28-2048.jpg)
![foreach ($items as $delta => $item) { $id = $item->getValue()['target_id']; $content = Drupal::entityTypeManager() ->getStorage($entity_type_id) ->load($id); $body = [ '#type' => 'processed_text', '#text' => $content->get('body_field')->getValue()[0]['value'], '#format' => $content->get('body_field')->getValue()[0]['format'], ]; } $elements[$delta] = array( '#theme' => 'something_custom', '#body' => $body, ); return $elements; Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-29-2048.jpg)
![<?php $result = Drupal::database() ->delete('people') ->condition('name', '%_' . $_GET['param'], 'LIKE'); ->execute(); ?> Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-63-2048.jpg)
![<?php $result = Drupal::database() ->delete('people') ->condition('name', '%_' . $_GET['param'], 'LIKE'); ->execute(); ?> Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-64-2048.jpg)
![<?php $database = Drupal::database(); $result = $database ->delete('people') ->condition('name', $database->escapeLike($_GET['param']), 'LIKE'); ->execute(); ?> Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-65-2048.jpg)
![<?php function _generate_password($length = 8) { $pass = ’’; for ($i = 0; $i < $length; $i++) { // Each iteration, pick a random character from the // allowable string and append it to the password: $pass .= $allowable_characters[mt_rand(0, $len)]; } } ?> Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-74-2048.jpg)
![<?php function _generate_password($length = 8) { $pass = ’’; for ($i = 0; $i < $length; $i++) { // Each iteration, pick a random character from the // allowable string and append it to the password: $pass .= $allowable_characters[mt_rand(0, $len)]; } } ?> Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-75-2048.jpg)
![<?php function _generate_password($length = 8) { $pass = ’’; for ($i = 0; $i < $length; $i++) { do { // Find a secure random number within the range needed. $index = ord(drupal_random_bytes(1)); } while ($index > $len); $pass .= $allowable_characters[$index]; } } ?> Tatar Balazs Janos - @tatarbj](https://image.slidesharecdn.com/letswritesecuredrupalcodepoland2019-190601152636/75/Let-s-write-secure-Drupal-code-Drupal-Camp-Poland-2019-76-2048.jpg)
Uploaded byBalázs Tatár
Let's write secure Drupal code! - Drupal Camp Poland 2019
The document is a presentation by Tatar Balazs Janos on writing secure Drupal code. It provides an overview of the presenter's background and experience with Drupal security. The presentation covers trends in security, types of vulnerabilities like cross-site scripting and SQL injection, and techniques for protecting against vulnerabilities such as input filtering, automated testing, and access control. It includes code examples and opportunities for audience participation through a bingo game.
Let's write secure Drupal code! - Drupal Camp Poland 2019
- 1. LET’S WRITE SECUREDRUPAL CODE! TATAR BALAZS JANOS DRUPAL CAMP POLAND WROCLAW, POLAND – 01.06.2019
- 2. Who am I? TatarBalazs Janos @tatarbj Works with Drupal since 2007 CTO @ Petend Drupal Security Correspondent @ EC Active mentor @ Mentoring community group Provisional member @ Drupal Security Team SecOSdreamer @ Secure Open Source day
- 3. Tatar Balazs Janos- @tatarbj
- 4. Are there sitebuilders? Tatar Balazs Janos - @tatarbj
- 5. Tatar Balazs Janos- @tatarbj
- 6. Demo Tatar Balazs Janos- @tatarbj
- 7.
- 8. Are there developers/maintainers? TatarBalazs Janos - @tatarbj
- 9. Have you attendedon a previous Let’s write secure Drupal code! session? Tatar Balazs Janos - @tatarbj
- 10. DrupalCamp Antwerp 2017 DrupalCampRuhr 2018 DrupalDevDays 2018 Drupal Europe 2018 DrupalCamp Oslo 2018 DrupalCamp London 2019 Drupal Mountain Camp 2019 DrupalCamp Spain 2019 DrupalCamp Belarus 2019 DrupalCamp Kyiv 2019 DrupalCamp Poland 2019 History Tatar Balazs Janos - @tatarbj
- 11. Trends in Security TatarBalazs Janos - @tatarbj
- 12. Tatar Balazs Janos- @tatarbj
- 13. Tatar Balazs Janos- @tatarbj
- 14. Types of vulnerabilities TatarBalazs Janos - @tatarbj
- 15. Tatar Balazs Janos- @tatarbj
- 16. Cross Site Scripting TatarBalazs Janos - @tatarbj
- 17. Client side vulnerability Unfilteredoutput Never trust any user input. We’ve seen the demo before ;) Cross Site Scripting Tatar Balazs Janos - @tatarbj
- 18. Tatar Balazs Janos- @tatarbj
- 19. Html::escape() – plaintext Xss::filter() – html is allowed Xss::filterAdmin() – text by admins Tatar Balazs Janos - @tatarbj
- 20. Bingo Tatar Balazs Janos- @tatarbj
- 21. Everyone has abingo card (check your bag!) If you answer well, mark the number! Wrong answer = no number! First who shouts BINGO! wins the price! Rules and etiquette Tatar Balazs Janos - @tatarbj
- 22. Round 1 Tatar BalazsJanos - @tatarbj
- 23. function custom_field_formatter_view(...) { foreach($items as $key => $value) { //... $element[$key] = array( '#type' => 'markup', '#markup' => t('<img src="!src" alt="@alt" />', array('!src' => $value['src'], ‚$alt’ => $value['alt'])), ); //... } return $element; } Tatar Balazs Janos - @tatarbj
- 24. function custom_field_formatter_view(...) { foreach($items as $key => $value) { //... $element[$key] = array( '#type' => 'markup', '#markup' => t('<img src="!src" alt="@alt" />', array('!src' => $value['src'], ‚$alt’ => $value['alt'])), ); //... } return $element; } Tatar Balazs Janos - @tatarbj
- 25. function custom_field_formatter_view(...) { foreach($items as $key => $value) { //... $element[$key] = array( '#type' => 'markup', '#markup' => t('<img src="@src" alt="@alt" />', array('@src' => $value['src'], ‚$alt’ => $value['alt'])), ); //... } return $element; } Tatar Balazs Janos - @tatarbj
- 26. 12 Tatar Balazs Janos- @tatarbj
- 27. foreach ($items as$delta => $item) { $id = $item->getValue()['target_id']; $content = Drupal::entityTypeManager() ->getStorage($entity_type_id) ->load($id); $body = $content->get('body_field')->getValue()[0]['value']; } $elements[$delta] = array( '#theme' => 'something_custom', '#body' => $body, ); return $elements; Tatar Balazs Janos - @tatarbj
- 28. foreach ($items as$delta => $item) { $id = $item->getValue()['target_id']; $content = Drupal::entityTypeManager() ->getStorage($entity_type_id) ->load($id); $body = $content->get('body_field')->getValue()[0]['value']; } $elements[$delta] = array( '#theme' => 'something_custom', '#body' => $body, ); return $elements; Tatar Balazs Janos - @tatarbj
- 29. foreach ($items as$delta => $item) { $id = $item->getValue()['target_id']; $content = Drupal::entityTypeManager() ->getStorage($entity_type_id) ->load($id); $body = [ '#type' => 'processed_text', '#text' => $content->get('body_field')->getValue()[0]['value'], '#format' => $content->get('body_field')->getValue()[0]['format'], ]; } $elements[$delta] = array( '#theme' => 'something_custom', '#body' => $body, ); return $elements; Tatar Balazs Janos - @tatarbj
- 30. 23 Tatar Balazs Janos- @tatarbj
- 31. In Drupal 7check_url calls check_plain to sanitize bad protocols properly. ? Tatar Balazs Janos - @tatarbj
- 32. In Drupal 7check_url calls check_plain to sanitize bad protocols properly. ? Tatar Balazs Janos - @tatarbj
- 33. In Drupal 7check_url calls drupal_dangerous_protocols to sanitize bad protocols properly. ? Tatar Balazs Janos - @tatarbj
- 34. 25 Tatar Balazs Janos- @tatarbj
- 35. Drupal 8 allowsFull HTML to be used by authenticated and administrator users. ? Tatar Balazs Janos - @tatarbj
- 36. Drupal 8 allowsFull HTML to be used by authenticated and administrator users. ? Tatar Balazs Janos - @tatarbj
- 37. 17 Tatar Balazs Janos- @tatarbj
- 38. Tatar Balazs Janos- @tatarbj
- 39. Use behat/automated tests. <script>alert('XSS')</script> <imgsrc="a" onerror="alert('title')"> Check your filters and user roles. Do not give too many options to untrusted users! Protection against Cross Site Scripting Tatar Balazs Janos - @tatarbj
- 40. Access Bypass Tatar BalazsJanos - @tatarbj
- 41. User can access/dosomething. Menu items can be defined to be accessed/denied. Many access systems: node, entity, field, views... Access bypass Tatar Balazs Janos - @tatarbj
- 42. Round 2 Tatar BalazsJanos - @tatarbj
- 43. <?php $query = db_select('node','n') ->fields('n', array('title', 'nid')) ->condition('type', 'article'); $result = $query->execute(); ?> Tatar Balazs Janos - @tatarbj
- 44. <?php $query = db_select('node','n') ->fields('n', array('title', 'nid')) ->condition('type', 'article'); $result = $query->execute(); ?> Tatar Balazs Janos - @tatarbj
- 45. <?php $query = db_select('node','n') ->fields('n', array('title', 'nid') ->condition('type', 'article') ->addTag('node_access'); $result = $query->execute(); ?> Tatar Balazs Janos - @tatarbj
- 46. 29 Tatar Balazs Janos- @tatarbj
- 47. mymodule.not_found: path: '/not-found' defaults: _controller: 'DrupalmymoduleControllerNotFoundController::build404' _title:'Page not found' requirements: _access: 'TRUE' Tatar Balazs Janos - @tatarbj
- 48. mymodule.not_found: path: '/not-found' defaults: _controller: 'DrupalmymoduleControllerNotFoundController::build404' _title:'Page not found' requirements: _access: 'TRUE' Tatar Balazs Janos - @tatarbj
- 49. 16 Tatar Balazs Janos- @tatarbj
- 50. Restricted permissions makeDrupal sites more secure by calling restrict_permission() method. ? Tatar Balazs Janos - @tatarbj
- 51. Restricted permissions makeDrupal sites more secure by calling restrict_permission() method. ? Tatar Balazs Janos - @tatarbj
- 52. Restricted permissions makeDrupal sites more secure by raising attention on the permission page. ? Tatar Balazs Janos - @tatarbj
- 53. 6 Tatar Balazs Janos- @tatarbj
- 54. A standard Drupal8 allows users to mistype their passwords 10 times. ? Tatar Balazs Janos - @tatarbj
- 55. A standard Drupal8 allows users to mistype their passwords 10 times. ? Tatar Balazs Janos - @tatarbj
- 56. A standard Drupal8 allows users to mistype their passwords 5 times. ? Tatar Balazs Janos - @tatarbj
- 57. 9 Tatar Balazs Janos- @tatarbj
- 58. Tatar Balazs Janos- @tatarbj
- 59. Visit node/nid andother urls Visit anything/%node Use behat/automated tests. node_access, entity_access Menu definitions user_access for permissions $query->addTag('node_access') Protection against Access bypass Tatar Balazs Janos - @tatarbj
- 60. SQL Injection Tatar BalazsJanos - @tatarbj
- 61. Unauthorized access todatabase resources. Do not trust any user input. SA-CORE-2014-005 – Highly critical D7 SA SQL Injection Tatar Balazs Janos - @tatarbj
- 62. Round 3 Tatar BalazsJanos - @tatarbj
- 63. <?php $result = Drupal::database() ->delete('people') ->condition('name','%_' . $_GET['param'], 'LIKE'); ->execute(); ?> Tatar Balazs Janos - @tatarbj
- 64. <?php $result = Drupal::database() ->delete('people') ->condition('name','%_' . $_GET['param'], 'LIKE'); ->execute(); ?> Tatar Balazs Janos - @tatarbj
- 65. <?php $database = Drupal::database(); $result= $database ->delete('people') ->condition('name', $database->escapeLike($_GET['param']), 'LIKE'); ->execute(); ?> Tatar Balazs Janos - @tatarbj
- 66. 31 Tatar Balazs Janos- @tatarbj
- 67. A highly criticalDrupal 7 core update remediated a Remote code execution vulnerability in 2014. ? Tatar Balazs Janos - @tatarbj
- 68. A highly criticalDrupal 7 core update remediated a Remote code execution vulnerability in 2014. ? Tatar Balazs Janos - @tatarbj
- 69. A highly criticalDrupal 7 core update remediated an SQL injection vulnerability in 2014. ? Tatar Balazs Janos - @tatarbj
- 70. 15 Tatar Balazs Janos- @tatarbj
- 71. Tatar Balazs Janos- @tatarbj
- 72. Use always drupalDatabase API! db_query with :placeholder (deprecated in D8, in D9 will be removed) Filter parameters Check the queries in code. username' AND 1=1 POST requests by curl Protection against SQL Injection Tatar Balazs Janos - @tatarbj
- 73. Round 4 Ready forsome other code? Tatar Balazs Janos - @tatarbj
- 74. <?php function _generate_password($length =8) { $pass = ’’; for ($i = 0; $i < $length; $i++) { // Each iteration, pick a random character from the // allowable string and append it to the password: $pass .= $allowable_characters[mt_rand(0, $len)]; } } ?> Tatar Balazs Janos - @tatarbj
- 75. <?php function _generate_password($length =8) { $pass = ’’; for ($i = 0; $i < $length; $i++) { // Each iteration, pick a random character from the // allowable string and append it to the password: $pass .= $allowable_characters[mt_rand(0, $len)]; } } ?> Tatar Balazs Janos - @tatarbj
- 76. <?php function _generate_password($length =8) { $pass = ’’; for ($i = 0; $i < $length; $i++) { do { // Find a secure random number within the range needed. $index = ord(drupal_random_bytes(1)); } while ($index > $len); $pass .= $allowable_characters[$index]; } } ?> Tatar Balazs Janos - @tatarbj
- 77. 8 Tatar Balazs Janos- @tatarbj
- 78. // custom_module.permissions.yml administer custommodule: title: 'Bypass access control' description: 'Allows a user to bypass access control.’ // custom_module.routing.yml custom_module.settings.form: path: '/admin/config/custom/settings' requirements: _permission: 'administer custom module' Tatar Balazs Janos - @tatarbj
- 79. // custom_module.permissions.yml administer custommodule: title: 'Bypass access control' description: 'Allows a user to bypass access control.’ // custom_module.routing.yml custom_module.settings.form: path: '/admin/config/custom/settings' requirements: _permission: 'administer custom module' Tatar Balazs Janos - @tatarbj
- 80. // custom_module.permissions.yml administer custommodule: title: 'Bypass access control' description: 'Allows a user to bypass access control.’ restrict access: TRUE // custom_module.routing.yml custom_module.settings.form: path: '/admin/config/custom/settings' requirements: _permission: 'administer custom module' Tatar Balazs Janos - @tatarbj
- 81. 20 Tatar Balazs Janos- @tatarbj
- 82. // contrib_module.routing.yml contrib_module.settings.form: path: '/admin/config/contrib/settings' requirements: _permission:'administer site configuration' Tatar Balazs Janos - @tatarbj
- 83. // contrib_module.routing.yml contrib_module.settings.form: path: '/admin/config/contrib/settings' requirements: _permission:'administer site configuration' Tatar Balazs Janos - @tatarbj
- 84. 26 Tatar Balazs Janos- @tatarbj
- 85. CSRF stands forCross Site Remote Fallout vulnerability. ? Tatar Balazs Janos - @tatarbj
- 86. CSRF stands forCross Site Remote Fallout vulnerability. ? Tatar Balazs Janos - @tatarbj
- 87. CSRF stands forCross Site Request Forgery vulnerability. ? Tatar Balazs Janos - @tatarbj
- 88. 32 Tatar Balazs Janos- @tatarbj
- 89. SQL Injection isa server side vulnerability. ? Tatar Balazs Janos - @tatarbj
- 90. SQL Injection isa server side vulnerability. ? Tatar Balazs Janos - @tatarbj
- 91. 13 Tatar Balazs Janos- @tatarbj
- 92. Cross Site Scriptingvulnerability is in the TOP3 of OWASP list from 2017. ? Tatar Balazs Janos - @tatarbj
- 93. Cross Site Scriptingvulnerability is in the TOP3 of OWASP list from 2017. ? Tatar Balazs Janos - @tatarbj
- 94. Cross Site Scriptingvulnerability is not in the TOP3 of OWASP list from 2017, but was in 2013. ? Tatar Balazs Janos - @tatarbj
- 95. 5 Tatar Balazs Janos- @tatarbj
- 96. In case ofno winner, extra numbers are coming! ! Tatar Balazs Janos - @tatarbj
- 97. 18 Tatar Balazs Janos- @tatarbj
- 98. 27 Tatar Balazs Janos- @tatarbj
- 99. 30 Tatar Balazs Janos- @tatarbj
- 100. 1 Tatar Balazs Janos- @tatarbj
- 101. 11 Tatar Balazs Janos- @tatarbj
- 102. 33 Tatar Balazs Janos- @tatarbj
- 103. Tatar Balazs Janos- @tatarbj
- 104. Security Improvements Tatar BalazsJanos - @tatarbj
- 105. *https://events.drupal.org/sites/default/files/slides/pwolanin-2017-09-ways-drupal8-d.pdf Many ways Drupal8 is more secure!* Twig templates for HTML generation Removed PHP format Site configuration exportable, versionable User content entry and filtering improvements User session and session always in ID handling Automated CSRF token protection Trusted host patterns enforced for requests Single statement execution for SQL Clickjacking protection Content security policy compatibility with Core Javascript API Tatar Balazs Janos - @tatarbj
- 106. Learn by Advisories TatarBalazs Janos - @tatarbj
- 107. Security advisories arefor Only stable modules No alpha, beta, dev d.org hosted projects @Maintainers: If you are contacted, be supportive! Drupal Security Team Tatar Balazs Janos - @tatarbj
- 108. Tatar Balazs Janos- @tatarbj
- 109. Hacked! Security review (simplytest.me) Passwordpolicy Encrypt Composer Security Checker Permission report Drop Guard Security Awareness programs + PHPCS Drupal BestPractice Sniff Security related projects Tatar Balazs Janos - @tatarbj
- 110. Tatar Balazs Janos- @tatarbj
- 111. SecOSdays 25-26 OCTOBER, 2019- SOFIA, BULGARIA Call For Sessions and Sponsors are open! Tatar Balazs Janos - @tatarbj
- 112. Questions? Tatar Balazs Janos- @tatarbj
- 113.
Editor's Notes
- #11 Einstein said: “insanity is when you do the same thing over and over again and expect different results”
- #13 Owasp: open web application security project
- #14 Reference for the XSS issue that was basically caused by a security misconfiguration.
- #24 Hide enabled blocks from selector that are used Context update from this wednesday
- #25 Hide enabled blocks from selector that are used Context update from this wednesday
- #26 Hide enabled blocks from selector that are used Context update from this wednesday
- #64 Not because of having db_query deprecated, but: The $field param is used to derive various table and field names, but in each case the Database API automatically escapes these values. Note that the API does not do this for all arguments!
- #65 Not because of having db_query deprecated, but: The $field param is used to derive various table and field names, but in each case the Database API automatically escapes these values. Note that the API does not do this for all arguments!
- #66 Not because of having db_query deprecated, but: The $field param is used to derive various table and field names, but in each case the Database API automatically escapes these values. Note that the API does not do this for all arguments!
- #76 Mt_rand is not secure enough!
- #77 Insecure randomness by Mass Password Reset (SA-CONTRIB-2018-043) by Greg Knaddison