search

SteamedPears / Code-Review

A web app for reviewing code (and other text), written in node.js using redis as the persistent store.
http://review.steamedpears.com
ISC License
1 stars 2 forks source link

Security Audit #32

Open cdelahousse opened 11 years ago

cdelahousse commented 11 years ago

Imported issue by spratt from 2012-07-06T16:00:31Z Originally opened as https://github.com/SteamedPears/CodeReviewClientMaster/issues/33

We really need to sit down and try to break the security before we demonstrate the app publicly.

spratt commented 11 years ago

@cdelahousse @bheesham @psimonyi One or more of us should do this for the next (and final) sprint. I want to get feedback from @asomayaji on how to secure our app before the end of the course.

spratt commented 11 years ago

@psimonyi is going to be lead on this.

We should meet with @asomayaji sometime this week to go over the common security flaws we could try to fix.

@cdelahousse @bheesham You both should come if you're interested in the security side.

spratt commented 11 years ago

http://redis.io/topics/security for when we start using redis

cdelahousse commented 11 years ago

Tell me you guys go see Anil. I'd love to see what he has to say. On Mar 25, 2013 1:23 AM, "Simon David Pratt" notifications@github.com wrote:

http://redis.io/topics/security for when we start using redis

— Reply to this email directly or view it on GitHubhttps://github.com/CarletonU-COMP2406-W2013/Steamed-Pears/issues/32#issuecomment-15378293 .

cdelahousse commented 11 years ago

From #102: I think we should start using a replacer function argument with JSON.stringify. https://developer.mozilla.org/en-US/docs/Using_native_JSON#The_replacer_parameter @asomayaji was speaking about whitelists and a replace function would be a super easy implementation.

spratt commented 11 years ago

@cdelahousse that's a great idea.