Perform Security Review of Code

[magneticstain]

Once the release has been tested and is ready for release, developers should perform a final review of the code for any potential security issues.

This may include usage of external tools, both for black and white box analysis.

[magneticstain]

All CLData APIs display results using the json content-type, assuring results aren't parsed as code by browsers.

[magneticstain]

Basic listing stats are all performed through the function Statscream.updateListingStat. This function utilizes the $.text() jquery method to update the stat container text, utilizing the built-in special-character encoding that comes with it.

Statscream.updateListingStat = function(selector, apiUrl, returnDataType, returnFieldNum){
    /*
        Query Calc API for requested stat and update the dataSink with the results
     */

    var stat = '---';
    var statWrapper = selector;

    if(typeof returnFieldNum === 'undefined')
    {
        returnFieldNum = 0;
    }

    $.ajax({
        url: apiUrl,
        dataType: 'json',
        success: function(calcData){
            // check if API req was successful
            if(calcData.success)
            {
                // parse stat
                stat = DataTron.formatReturnData(returnDataType, calcData.result[0][returnFieldNum]);
            }

            // update view w/ results
            statWrapper.children('p').text(stat);
        },
        error: function(){
            var errorBot = new ErrorBot(2, 'Could not access Calc API');
            errorBot.displayError();
            errorBot.logErrorToConsole();
        }
    });
};

[magneticstain]

OWASP checklist completed.

https://www.owasp.org/index.php/Web_Application_Security_Testing_Cheat_Sheet#The_Checklist

[magneticstain]

sqlmap testing to be performed on CLData API URLS:

• /CLTools/CLData/api/v1/calc/?m=avg&f=price&o=desc
• /CLTools/CLData/api/v1/calc/?m=count&f=location&o=desc&l=1
• /CLTools/CLData/api/v1/metrics/?t=monthly */CLTools/CLData/api/v1/metrics/?f=price&t=daily&o=avg

Results coming soon.

[magneticstain]

OWASP ZAP scans show no vulns

[magneticstain]

sqlmap scan shows no vulns as well.

Security review complete.

[magneticstain]

Completed with commit https://github.com/magneticstain/CLTools/commit/66f84f6c8e3643a21dfbf5f1923fc7092822a327