Eliot Sykes issues

Results 142 issues of


                                            Eliot Sykes

Invalidate any account credentials received over plain HTTP

Consider guideline to invalidate any credentials received over plain HTTP. Consider sending courtesy email to account owner?

Mitigate window.opener exploits

Set `rel="noopener noreferrer"` attribute on `` links More at: https://dev.to/ben/the-targetblank-vulnerability-by-example Consider if `link_to` and other `link_*` helpers should automatically set the `rel="noopener noreferrer"` attribute if `target` option is set to...

Protecting webhook endpoints

- Consider safelisting incoming requests by IP address. E.g. Stripe provide a list of IP addresses that your Stripe webhook endpoint could verify incoming requests against: https://stripe.com/docs/ips - Consider adding...

Consider configuring mail providers (e.g. Mailgun, Mailchimp) not to store, track and/or shorten sensitive URLs (e.g. reset password links, any URL with a token)

Mail providers (such as Mailgun & Mailchimp) are often setup to track all links in the emails that are sent through their servers. This means your provider may be logging...

Mention Liquid insecure default: rendering does not escape interpolated variables

This may surprise developers used to other templating engines used in Rails, but, at time of writing, Liquid does not behave like ERB/HAML templates in Rails where interpolated values are...

Consider guideline for ENV passwords/tokens to be hashed and not in the plain

Say env is used to store an admin password: ``` ENV['ADMIN_PASSWORD'] = 'topsecret' ``` And authentication uses hashed value: ``` authenticated = ActiveSupport::SecurityUtils.secure_compare( ::Digest::SHA256.hexdigest(ENV.fetch('ADMIN_PASSWORD')), ::Digest::SHA256.hexdigest(params[:password]) ) ``` Perhaps favor storing...

Encrypt credentials (Rails 5.2) / secrets (Rails 5.1) in guidelines

Rails 5.2 is looking like it will replace encrypted secrets with encrypted credentials - see PR here: https://github.com/rails/rails/pull/30067 Rails 5.1 was released with an encrypted secrets feature: https://github.com/rails/rails/issues/25095 + PR:...

Eliot Sykes