Good morning, everyone.
We're starting class now. So just where we are right now, today is November 28th, US Thanksgiving.
For those of you who know about that.
I plan to have some pie this afternoon.
So…
we only have a few more classes
So December 5th is December 5th
So December 5th is next week. So next week's the last week of classes so
Just two more after this.
where you know the tutorials, you should be
you know, tutorial eight, you should get done by the end of tomorrow
Fresh demo, you have till december 6th.
Remember, though, that
Tutorials are
technically over at this stage
We will have TAs attending them in person.
you'll notice Lars has posted
updates to the TA schedule and stuff
I highly recommend you get your things checked off
as soon as possible.
don't wait till next week.
You may not be able to get it done because they just may not have the time. So go in as soon as possible to go ahead and get that checked off.
Remember, you don't have to have finished the tutorial.
You don't have to have done everything. You just have to have made a reasonable attempt at some of it and then
And then you can get marks for it.
um so
go ahead and do that because we're at the end of the semester. Everyone's busy.
If you're going to get checked off by the TAs, you're going to have to do that. And if you don't.
you don't.
I will say the tutorial grades
And the quizzes.
The way I calculate grades at the end of the term, and they said I do multiple
I do multiple grading schemes. The tutorials and the quizzes
cannot bring your grade down.
they're going to be, you know.
designed them to be things that should boost the grade for most of you. But if you haven't been diligent with them.
I'm not going to let them reduce your grade because I have other grading schemes where basically it kicks those out and increases the weight of the rest.
Because what I'm really interested in is you demonstrating that you've learned the material and these are all
participation slash, you know, really easy questions
so um
Technically, tutorials are.
At this point. So next week, there will be there
There will be some at least one TA in the tutorial rooms
But that's it. And then there's office hours so yeah
get checked off as soon as you can.
what was i think uh so that assignment four assignment
do um
is you have a have one tutorial dropped.
There'll be someone there in the tutorial room
In all the remaining tutorials that will have one person there but
only one.
So just, and so if you're like waiting till like next Friday or something
Or like today get checked off.
And remember, just go and just go
go to whichever tutorial
Even if that's not your assigned tutorial, if you want to get checked off a different time or assigned, just go to an office hour.
get it done sooner rather than later.
And then also assignment four assignment four
is due December 4th.
on the last day of class, I will be going through the solutions.
of assignment four.
Of course, you can turn it in. I mean, it's due up to just before class but
you need to, you know, so, but I can't give you an extension because that's the last day of class and then
the exams a week after so
Assignment four should be easier than assignment three.
And remember, assignment four does not require you have done tutorial nine. Tutorial nine is its own thing.
One thing I wanted to point out
with this code is with this code
If you look at the ad submission logic.
Fresh demo won't be on the final exam.
For now, it's going to be on the assignments.
Fresh demo is more to show you how these concepts transition into
real world modern web development. And the thing to know is like
There's a lot of complex machinery
In fresh.
But it's not really doing anything we haven't really covered.
But anyway.
then there, so what I want to talk about here is with ad submission
If you look at the logic here.
This doesn't really affect the questions.
that I asked in the assignment. But some of you in trying to understand the code, I think have gotten a little confused about this.
Let me make this a little wider.
I'll make sure that's it.
I didn't mess things up.
So if we look at this logic here, what does it say? If there's no session
They're trying to status unauthorized user not logged in.
And then…
you know we get an account
get this, you know, get the submission.
And then if we don't have a submission or the submission doesn't have a file and the submission doesn't have file contents, we say.
Okay, that's a bad raw upload.
So we've returned that. That's fine.
If the account
So we have a valid submission we have at least a
doesn't valid, but at least a proper raw submission uploaded
Then we go here and check to see, do we have an account does the account
Are they a student? And if they are, then we, you know, if they aren't, then we kind of
we exit out saying forbidden
So that's actually, yeah, so that's actually where
things are messed up. So if you look here, this is saying if it's not a count student.
And if that if fails, it goes here.
But that's not really what this error is.
What this error is, is that the submission
You don't have, you don't have an account.
If you don't have an account
or you don't have student access.
you're not allowed to
So really what they should say is you're not allowed to upload
a submission.
But assuming it is, you are allowed to do it.
Then you check the submission.
If you didn't get one, okay, invalid parsed
One, we add the submission.
We add the submission we say.
So, hey, got the data. Otherwise.
internal server error because
you know if it added it properly
But notice nowhere in here do we check
that the student ID of the uploaded submission
matches.
to the current users that.
That's not in this logic.
And so you have this error message
here that says this but that's
nonsensical. If you want, I can spend time, we could spend time in class fixing the logic of this.
But it's not really material to the assignments.
But I just wanted to point that out.
Should you look over the assignments for the assignments are the core of the material for this class, so yes
That is definitely what you should be looking at to understand what's going to be on the final.
So this error message
So that's what I was trying to say. This is not about an invalid submission. We say invalid submission.
we mean that we mean that
it checks submission says it's invalid.
That's what we really mean. When check submission says it's invalid.
Then, I mean, you could say it's either a raw, you know, it's a bad raw request. Either that's invalid
or it's invalid because check submission, those two things.
the student ID not being the same that's
it's not allowed. It's an unauthorized option, but it's not invalid data.
So…
So yeah, so that's there. So yeah, this code is
this is wrong.
I'm…
I could fix it.
I don't think I'm, but I don't think I want to change the code on you guys. I know you're all working but
I don't know.
Maybe I'll upload a fixed version.
If you all think that would be helpful, I'm happy to upload a fixed version.
So there's a question.
Will I be counting all lecture quizzes?
I don't think I'm going to drop any.
But I will like if those grades would, if the lecture quizzes would bring your grade down
Then I'll…
Then I would, they'll be excluded from there so
the quizzes and the quiz
the tutorials cannot bring your grade down.
So this questionnaire for question nine after adding a file name and content to the database
Would it be okay to still input the other data in the same format as was given?
and putting into the field and student id on it so
So question nine.
Yes, no, no. This question nine is this
is saying you should store
the file name and file contents
in addition to what's already stored. It's not saying to remove anything that's already stored.
It's saying you also want this information.
And if you think about it, it makes sense to do this
okay, you have the parsed version of the assignment, but what happens if the parse somehow
messes up.
how do you know that later? How can you check it? So if you have a copy of the raw assignment there.
then you can later find out, you know, figure it out. And similarly with the file name, it's good to know
Who did this come from? What would the file name given
that could be useful later on. So this is additional information, not replacing what's in the database.
Do you want to store the data in a new table or an old one? I did not specify.
where it should be stored. I said it should be stored
in the database.
I think it's clearly one's more complicated than the other, whether you put it in the same table versus another table but
It's not specified.
Yeah, so, you know, we're doing no deletion here. So there's nothing in here. There's a question you're saying
asked to store not modify the program to take out the data layer. There's no deletion here. We're not deleting any data.
Do we have to display it in the submission listings page?
No. And in fact, if…
there's no, I mean, you could…
But that's not what the question's asking for. It's saying for the data to be stored.
Not for it necessarily be listed. And in fact, actually, if you look at the question.
the assignment listing. Arguably, it's pretty useless.
for real assignments because the columns are so narrow, you probably need another format
to properly output it.
But this question isn't asking to do other things. I try to be very specific in what I'm asking for here.
Yeah, so yeah you just add it to the database and not deal with otherwise. You might go like, why would I want to do that? I mean.
Oftentimes, one of the things you do in databases is you put data in there
that you might need later.
because it's data that you have that you want to keep track of.
Sometimes it never gets used or it only gets used when someone writes some esoteric report or something and it's just in there.
Other questions?
So for question six.
By looking at the accounts table, can you easily tell if two users chose the same password and off demo two?
How do you know?
Um…
I'm not saying this is a feature.
I'm saying i'm saying i'm saying
I'm saying if someone has access
to the accounts table.
If they grab that they grab that
database and got that table and ran their own SQL queries on it and their own copy of SQLite.
And, you know, did so is
Can they easily tell if two users chose the same password?
And how do you know?
That's what that question is asking.
Anything else?
Okay, so…
Question six is not asking about code.
This is asking about the nature of the data in there. Question six is not asking for any code.
This is more about the nature of the data that's stored in it.
Good questions.
Any other assignment?
Questions?
Okay, so here, if you wanted to link the two tables, would be recommended doing in SQL or
If you want to link two tables.
You can do it at the JavaScript level or you can do at the database level. In general, doing it at the database level is more efficient.
Because it allows the database engine to optimize the doing of the query.
But these are simple things.
So you certainly can instead do it in JavaScript.
But more typically, if you wanted to link two tables, you would do a join.
And so that that's
We have not talked about joins. This is not a database
class, but it's certainly stuff that's worth
learning about.
But one of the reasons I omitted talking about things like joins and stuff is like traditionally we've taught
this course with MongoDB.
And MongoDB
at least used to know, it may support it now, but it used to not even support the idea of joins.
it was just a
is effectively a store of JSON objects called documents.
And there really wasn't much connection between them.
So it's not strictly necessary in the context of a web
class.
But it's certainly a useful technology. So I'm trying to, we cover so many different technologies i'm trying to
give you a simple version of everything. There's certainly more elaborate things to talk about for all of these.
So there's a question about session length.
here.
thing to understand
I would expect you to figure out how long sessions are
by looking at the code.
In general, sessions are
tend to be valid for longer than you want to wait around.
When you want to test to make sure it actually does what it seems to do.
I would then use an absurdly short one. I wouldn't even do 10 minutes. I might do
one minute or something. So you can see that you can log in and it's valid and then log in again and then it's not valid.
But yeah, I wouldn't try i wouldn't try
play with trying to see if the sessions work and testing it using
default value because the default values
pretty long.
um
Other questions?
If there aren't any more questions.
I'm going to talk about something
Different?
Is it lecture 21?
This is Lecture 21, isn't it?
you know you're at
Yep, it's lecture 21.
I figured I should at least spend a lecture spending some time talking about something I do know something about.
related to my research interests, which is
web security.
and how that relates to how that relates
what we've been doing in this class.
So…
When we talk about computer security.
we're talking about, traditionally we talk about things like
goals.
So normally it's confidential
confidentiality, integrity
and availability. So can you keep things secret that shouldn't make sure data hasn't been corrupted and make sure
the data systems and systems
keep running.
There also tends, many say like entity say
authentication.
is added in and I think maybe some others are things, but I tend to think it generally boils down to
If you can maintain these things
you basically get you have to the other things are all in service of those
Goals.
the one thing is that that's you know that's that's availability
So…
Roughly speaking, you say data and stores are only provided an authorized entity. That's also an availability aspect
integrity, but it's more of the confidentiality side you see
umbrella terms, we map it to concrete things, it gets a little fuzzy.
So I want to talk about the good things I've shown you and
the not so good things I've shown you.
So what have we done mostly right with respect to security? Of course, one easy one is um
So we've done secure password storage.
Which is good.
we've done um
And we've done sessions with exploration and strong session IDs.
So these are both, you know, help make sure that, you know, and take yourself. So these are two
important things. And there's one other thing that I've tried to do.
Which is…
The proper primerization of database queries.
So avoiding its SQL injection and vulnerabilities.
These two are pretty obvious, I feel like. Okay, the password
If someone steals your password database, they still have to guess what the passwords are.
That's good. Making sure that
if you have a web session that they can't just hijack it by stealing your cookies
that's good.
we have but but this whole
Proper pronunization of database queries.
to avoid SQL injection.
That's a little funnier.
And it's worth trying to understand
So when we say SQL injection, we're saying the attacker is able to execute arbitrary SQL queries
By injecting malicious inputs to the application.
What do I mean by this?
Let's see if I can show you this.
Let's go.
I'll go ahead.
I think I have.
Okay.
So I'm now here. I've got a database here.
Oh.
I've got a list of tables.
I'm trying to remember how to get a list of tables in SQL. Let me just look it up.
I'm just searching for that.
list all database.
dot tables, right?
a Saturday.
Oh.
So here we have here.
a database.
We have the entries from assignment three.
Now, if I said…
Select.
That works.
This, nothing there.
So this is a kind of query that we have in our code.
where we just do this sort of thing.
Where does the student ID come from?
The student ID comes from the user when they set up their account.
and potentially comes
from the uploaded submission.
So that is user input. It's not directly controlled by the application. It's something the
user provided at some point and then is being put in here.
So.
What if I instead had this
I said, yes.
So notice what happened here.
So if I just had this
number here.
This by itself
returns nothing.
you know this is the original thing. But if I say insert into this
Instead of inserting this number, I would instead insert the string. Like what if I made the
Instead of the student ID being just the regular number, what if it was this?
Plus all this text.
What if we just input that to the thing? Then all of a sudden that gets put into the SQL statement.
it parses and notice the semicolon ends one statement.
and then starts another statement and now you the attacker has allowed itself to do
a completely different SQL statement.
than the one that was intended. So the original one happens
But then another one happens.
Not good.
So like if that semicolon
If it was in quotes.
Then…
it wouldn't affect the query because it would just consider that to be one of the inputs but
If it's not in quotes.
then you probably might say, well, wouldn't it have been fine if we just quoted this well
What if I could stick quotation marks into my input? I could close off the quotations that, you know, the quotes that you had and then start a new thing
and then close the other quotes later.
It's a tricky thing.
So as a strategy this is very
um major um other strategy
So one way to do it is with
you know you can try escaping. It's very error prone
lots of ways to make mistakes. It becomes a little game with the attackers. Did you escape this? Did you do that? I mean, it's
It's a never-ending game, but a better way is to separate out what's the SQL command and what's the user input and make it so that
you know the it basically always knows which is which. So there's no way for an attacker to turn data into code.
So let's look at our
Let's go ahead and look at our code, for example. So let's look at
Let's go ahead and look at assignment three.
I'm going to look at that code.
I'm not going to show you the solutions.
So here's our authDB.
He's the one doing all the commands.
And so
What you should look for
is where is user input being put
into a SQL command.
Here, we are making a, using a template string
And this we're interpolating data. And so if this
variable was controlled by a user input.
this would be unsafe.
But it isn't. The submission table
and create Q fields, these are all hard coded into the code.
they're not user inputs they're
whoever's running the system's inputs so those so the question is are they trustworthy or untrustworthy inputs?
These are trustworthy inputs, so it's perfectly safe.
to put them in here like this.
This is what's dangerous to do.
if it's untrusted input.
And so you see, we do that again here. Again, off-table is trustworthy. Session
trustworthy.
And here again, when we're building up, so it's not things where it's building up, we say insert a replace into submission table, student ID, query fields like
that's all there.
But now look what you do.
We have this thing of values.
And the values and the values
are question marks.
And so by doing this in the actual SQL command.
We have question marks.
And those question marks are then filled in by a second array
that we pass into db query which is this array right here? We could have put this array
directly into the string.
We didn't actually have to do it as question marks. Instead of the question marks.
We could have just put the values in there.
But if we put the values in there, we then make us susceptible
to SQL injection attacks.
And…
I'm not sure I could have missed it. I never done a thorough review of this, but I'm pretty sure this is what I did.
And it's like this one
all trustworthy inputs.
So it's all fine.
This one, again, untrustworthy input.
student ID isn't.
supplied from here
So this, so using values, it's not so much the values, it's using the question.
Marks.
And it's the question marks where we have the parentheses
You know, we have an array of, remember, this is an array of parentheses with question marks in it.
So it's not values. Values is just how you specify. It's that we're not putting the actual values
in the command string.
the values have to be filled in by the query engine
you know, sending it separately and so this is
a parameterized query is a thing all SQL engines support. And it's something that allows you to separate
the data from the code.
And same thing here. So not this one, but this one. Notice here we say select name from this
where a student's ID equals question mark.
Look at the query for name.
I will check that in a second. Did I mess that one up? I might have. So select name from…
Oh, yeah. This is exactly what I'm looking at. So you select name from here where student ID equals question mark.
And then the next parameter to this is the student ID.
So there, the student ID is safe
Even if it had weird things it would just
wouldn't show up. It just wouldn't match.
It's the question mark that saves us.
So I think, so I'm trying to find the other
So again, here we see here
Select count from this. So again, this is building the string up
from a variable, but that's a constant one, that's perfectly fine.
Oh, sorry, I realize you can't see my cursor. No, you can see my Emacs cursor.
This is my mouse cursor that's messed up. So yeah, so here
you see this stuff.
this is safe, even though submission table if it was
untrustworthy input. This would be dangerous but it's
But then add account
Again, we say insert into table here, username, password. So we name all the fields and then values
question mark question mark, question mark, question mark, question mark.
And then there's this array here with the actual values.
I could have put these into here instead of the question marks. You don't have to use a question mark.
the question marks.
are what prevent are the key way you prevent SQL injection attacks.
Because now, because now
db query knows that this is not these are not commands. These will never be
SQL commands. If they are SQL commands, it's because the database engine is doing something very stupid.
That's not a bug in your code.
So this is very important.
idea insecurity.
Which is, I mean, if you just look through it all, like you'll see here is
you know off table student id equals
Ooh.
Oh, that's wrong.
Okay, Cal, you mentioned that. This one's wrong. This is vulnerable. See.
darn it.
Get name is vulnerable.
So if you decide to insert
If you made student ID not just a student ID here.
you could insert an arbitrary new SQL command.
So that one I messed up.
How should that be fixed? That should be a question mark.
And student ID should be a second argument to this query thing.
And then here, this one does it properly. We have the values, question mark, question mark, and then we have this here.
get session
Session ID is question mark
So it's there.
Yeah, I did it find everywhere else.
This is why SQL injection is such an annoying thing.
And this is actually one reason why
in regular production code
Normally, people do not
spend a lot of time mangling SQL queries.
They normally use
some abstraction layer which builds up the queries for you.
And one reason to do that is to avoid the issues that come up with when you're building up your
SQL command that you might accidentally
leave yourself vulnerable to a SQL injection attack.
Yeah, but…
Get name? Yeah, that's name
that's bad.
Donets.
Okay, I was so happy with myself.
So.
There's a general pattern here.
So this is sort of a general thing. When we talk about SQL injection, it's one example of
code injection attacks.
So someone else provides, a user provides input to a system
that input's supposed to be data
But somehow.
that data gets treated as code.
And when it gets treated as code, then it allows the attacker to run code in some
privileged context and thus allows them to do other things.
The classic example of this.
So if you're talking about
buffer overflow attacks.
This is…
This is the classic.
Does anyone know what modern systems have a number of defenses?
Anyone know what some of these are?
So I'm curious, maybe you've heard of these
Yep, stock canaries.
They are.
compensation.
No execute memory is another one that mitigates this because a classic way you would have this work is you would have this
buffer that you'd overflow and what you do is you'd write past the end of the buffer
in order to over control things. And what you'd want to do is change the return address
of the function to be an address
That's inside the array. So when the function returns, it all of a sudden jumps
into the array. And so that
the attacker would have injected machine code there, which would then start running.
And do whatever they wanted.
But what happens if that happens
the memory where the array is, is marked as not being executable. You can't have the instruction pointer jump into it and do anything effective.
generate a fault.
So these are all these are all these are all
So that's no execute
Stack canaries is you put a special value
on the stack, so on the C stack and so that if
if you write past the array.
when you return from the function it will check
the canaries basically little data that's sitting in between other values. And if those values have been corrupted.
Then.
the program knows its memory has been messed with and it can just crash with an error.
or something rather than continue executing and potentially doing bad things.
the um the reason why it's
So it's like canary in a coal mine.
the attacker, those values are normally random, so the attacker can't just overwrite them with whatever they
want. And you might say, well, why can't the attacker just see it? Well, the whole point
is the attacker has to first
do this right blind. They can't actually control the execution of the program and
you know, until they gain control this
So they had stopped the canary from
setting things off because before they've gained control.
And then address space layout randomization is moving the way things around in memory.
So that the attacker
doesn't know where to jump.
Like you might be able to override a pointer but
they don't know where to point because they don't know the structure of memory.
So these are all classic things in C.
These are not things that are why you technically web
apps can be vulnerable to these things like if you're using
let's say a library
processes images and it's written in C and it has some
memory corruption vulnerability, then maybe your web app could be compromised by something like this.
But for the most part, web applications
So there's lots of opportunities for code injection attacks.
they just use different code.
Because, you know, again, when you're working in a managed programming language, when that automatically manages memory.
Unless the runtime is
buggy in a very unusual way because these sort of bugs will be caught because they'll cause less problems
you're not going to corrupt memory you're not going to go
there's no way to write code that's going to mess up.
how pointers are stored or something lets you jump into things but
There's all this dynamic code.
is which part of the OS?
If you're talking about these things, no execute memory requires
operating system support.
ASLR typically requires memory support, although it can be done in user space.
Okay.
And then stack canaries
um
those are actually often supplied by compilers.
That's built into the executable so like
GCC New York will support it.
So…
let's see, you have client-side JavaScript, server-side JavaScript.
So code can be injected
with any of these runtimes.
So there's no…
And so you need to program defensively in order to avoid these kind of things.
The JavaScript, so we've worked on the SQL stuff, the code I've shown you has mostly shown you
how to defend against SQL injection attacks.
I've not shown you how to defend against
Um.
JavaScript errors.
So I'm sitting.
You really include all of it.
All these are interpreters that are running. They may not be fully Turing complete, but they can potentially integrate with the other parts that are.
And so they can be used to do all kinds of things. So like if you insert some HTML,
HTML, you may not be able to do much with it, except that you can specify a script tag. And the script tag can then have JavaScript.
that can then do you know
do all the JavaScript things.
Um…
And…
The server-side stuff, like server-side javascript
like code injection, like that's just normal application level security are you
You normally, server-side JavaScript is normally not much of an issue
So the reason why server-side JavaScript
We'll say.
start shortening it so you can see it. So code injection vulnerabilities
And server-side SQL are common. That's SQL injection attacks.
code injection vulnerabilities in server-side JavaScript are rare.
Because you have to use eval mostly.
So in order to do this, in order to have code injection
from what was in the JavaScript itself, you'd have to construct a string and then tell JavaScript to run it.
as JavaScript code. If you do that, JavaScript does allow you to do that.
There are scenarios where you want to do that.
So you can parse a JSON object by just
handing it to the JavaScript
runtime.
And so that's where you could just say evaluate it. That's what evaluate eval is.
And it would parse it. And you could do that to get a JSON object out. We'll basically have it added to the environment.
then you have access to all the other power of JavaScript, which you don't necessarily want. That's why JSON parsers are used even in JavaScript. It's in a sense redundant.
The JSON parser is
JSON parse is much safer
than running eval on it, even though functionally
they could do the same thing.
So again, for Python or Java for a backend. So with a language, you have to have data treated as code.
if you're talking, you know, there's always, if you have unsafe memory management, you can inject
data can be treated as code because you corrupt memory and then pointers allow it to be used. If you're talking about a higher level language.
like Python or Java.
it's possible to do code injection.
it's hard because it's mostly
you're not generating code on the fly.
And so you're not generating, like if you construct a string and then say, this is Python code, you can do that in Python. You can say, this is Python code, run it.
But you normally don't do that.
Same thing for same thing for
Same thing for Java java
actually is most almost always compiled.
there are ways to do it, but most of the time you don't have access
to Java compilation. It's all running as not as machine code, but running as Java bytecodes that are
Run there.
machine code injection in Java itself is actually not so common of a problem.
I'm not saying it never can happen, but it's not really so much an issue. JavaScript is much more dynamic. There's this notion of
You can kind of create things as you fly so
It can be, especially when you have JSON being interpreted by
of the JavaScript engine, that was much more of a problem.
server-side JavaScript isn't so much subject to it.
So this is the real problem. If you think about client-side code.
It is very vulnerable to code injection attacks.
And there's this particular class
of code injection attacks.
in client-side code that are important to understand.
Although the name is horrible.
But…
But there it is.
So the question is, so since there are higher level languages, most of the work related to memory is automated and so it's hard to inject code.
it's hard to, so with automated memory management.
it's very hard to inject machine code.
There's always bugs typically
if you use a C library, something at that interface where there's a bug in the runtime, then
you might be able to do it but that's um
that's much less common, but it does happen.
What I'm talking about here though, anywhere there's an
interpretation engine, there's an opportunity for problems.
And in the client, it's just…
Yes.
Cross-site scripting is exactly what I was going to talk about.
So…
But it's not the only thing you can do.
It's one particular class.
So, I mean, rather than, I think you can say
I mean, they're really better thought as code injection attacks
They're better thought of as code injection attacks at the level of HTML CSS JavaScript, but with a server component.
structured here.
What?
This is the key thing to understand about cross-site scripting.
is it's really about the attacker has uploaded something bad to the server. Remember, there's a database. You're always uploading things.
And then the defender
is targeted by it.
So how could we do that?
That's the kind of thing you could do is like
If you upload an assignment with malicious HTML, CSS, JavaScript embedded into the assignment.
Then if someone lists all the assignments.
then…
they could uh they could
whoever's running it, the admin would then potentially arbitrary code to run it in.
One thing in attacker might want to do is I want to see what everyone else answered on the assignment or maybe like find out who's in there. So how do I just…
How does the entire get confidential information?
a privileged user executes their code. Like I've got access to all the submissions.
When I view it now, all of a sudden it sends a web request, takes the entire page and just sends it off somewhere else.
I'm pretty sure, I haven't actually tried to do it, but I'm pretty sure AuthDemo is vulnerable to this kind of thing.
So why I see this is not it won't be so much
What?
So we look in AuthDemo 2.
and we look at the, actually it's more, you look at these templates
And when we build these templates, the student id list.
The student ID list is incorporated here
What's to prevent student ID lists
from having arbitrary HTML.
And inside of that arbitrary HTML,
there could be arbitrary css
and JavaScript.
You know, he embed a script tag in the
someone's student ID. You might go, well, a student ID is only supposed to be this long. It'll be like 10 characters. What are you talking about? There's nothing in the program that prevents it from being thousands of characters long.
We have no constraints on the length of a student ID and
SQLite will happily store arbitrary amounts of data in a field. So that gets put into here. You have arbitrary code
running inside of running inside
you know, inside of the list of
So this is just…
This is just in the student ID list. This is actually in the analysis. And the same thing happens
When you…
So this is analysis.
Oh, yeah.
for actually for list submissions
situation might be better because it's sending it
as a JSON object, but I think that JSON object
When you manipulate the inner HTML stuff, you can have arbitrary code in there.
Yeah, I'm pretty sure you could.
So the list code is also there.
is also vertical.
We look static.
admin list.jance.
So here again, we've got this question.
Well, I is not, you know, that's not something i'm not
row markup.
What's row markup we just take
the entry from the question that's brought in and we're just sticking it between these tags.
This sort of stuff. See, doesn't this look kind of like a sequel?
injection attack, but it's just that the level of html
You stick stuff in there and it could be
anything and you can take control of the web page
And when you're taking control of the webpage you can, you know.
do an attack? Because the web page often
In that context, it typically has privileges.
Isn't there a max size of text in SQL?
So in a classic SQL database engine.
It will enforce pretty strict limits on the size of fields.
SQLite doesn't.
it's very flexible in what can be stored in fields.
So it's a…
I mean, you could say the nice advantage of it is you know do things, but it can potentially be a problem where you're like.
Oh no, I stored a bad student ID.
what would be the right way to do this is like we probably should be doing some input validation to make sure a student ID really looks like a student ID.
So that's so
Now we're going to talk about
how do you remediate this?
So there's two basic things.
Filter.
So if you filter it.
you can make sure that the untrusted input fits a safe pattern.
and say these are all numeric, make sure they're all numeric digits
But the other basic thing is this notion of escaping.
So another is to transform characters that could allow code to be injected into safe forms.
So do you all know about um
So this is something important to know about HTML.
I'm going to share back to mine.
Go here.
So you see here which characters need to be escaped in HTML.
So same as XML. So these are
So you want to make sure, so ampersand becomes
outside AMP, less than becomes less than, this becomes greater than.
And then you may also want to do escape quotes
So HTML has these character sequences that replace these special characters.
So this is a little small.
So quote becomes at sign quote.
single quote becomes single
You specify the hex value of it.
So like it but but the weird thing is like, there's all these um
Yeah, actually, I think, yeah, because…
What I'm hesitating to think about is this notion of
Unicode characters.
the alphabet in modern systems is Unicode. Unicode is an alphabetic system that can represent arbitrary characters things
So you have not just things that are like
greater than or less than, but you have other characters that look kind of like them, but that doesn't really matter for this purpose because
the html
parser in a browser won't if it's something that looks like an angle bracket
less than or greater than
But it isn't actually those characters. It'll just go like, I don't know what this is.
So ASCII is a subset of modern UTF-8.
ASCII is just for uh really
English and it was developed in North America. It's been through american
It's an American standard.
modern character encoding is in Unicode.
Unicode doesn't really come into this particular issue.
But it does come up in other security contexts.
But escaping
This might seem kind of simple. You just need to do a global replace in a string
for these character patterns.
And…
it is a thing you can do but you can do
It's a little trickier. There's always like little gotchas.
Where is it? So you say like title replace string with that
replace all with this.
You must replace the app first. It's obviously been easy to make sure your coach looks like this so
It's like, here's a little bit of code here to
escape your thing.
Oh, yeah. And here it is adding semicolons because semicolons can also be important so
that's good for SQL injection. So you want to escape all these characters
And if you do that, you've sanitized
the input. And by sanitizing the input
then you're making sure that if it gets displayed to a user, it won't get
interpreted.
you'll notice that in a lot of things
that allow you to enter input
into like social media posts
wikis, blog posts or things.
there's often little languages
used to encode
information.
in those things like GitHub also, I want to make a web page. Why don't they just let me put in HTML?
By allowing them to add HTML, they potentially make things vulnerable to cross-site scripting attacks.
They had to make sure they do their escaping well. But one alternative to that is you basically say, we're escaping everything.
So you can't put in any HTML tags that will get interpreted.
But if you want HTML like effects, you use a different language.
So this is what happens when you say use Markdown.
Markdown, a markdown parser will look through and and
turn things in but it won't they'll have to very carefully decide oh this all used to do this kind of formatting and it won't be
able to do arbitrary HTML.
makes things much more secure.
This is a large topic.
I'm more doing this not so much to teach you
how to do these things properly
It's more just to make you aware that these are very real issues
I've shown you some solutions. I haven't really talked about other solutions.
These are things you really want to do. One reason to use
frameworks.
when doing web development.
is a lot of times they will take care of these things for you.
They will make sure to escape input that's displayed like but
Not always.
Which I find kind of
irritating.
So you can't be completely sure. You have to kind of check the framework to make sure it's doing what you think.
Web security is this big
there's so much to it.
And it's a problem that's not going away.
And I could spend quite a bit more time talking about how we ought to approach it as a problem.
at least now you've kind of seen where some of these issues come up in the context of
the code that we've actually written.
And I'm out of time. So unless there's any last questions.
So there's a question about interviews. Okay, so all the interviews have not gone out.
I will send email once the request next week I will be spending a lot of time doing interviews.
I'm not doing interviews for the rest of the week. It is US Thanksgiving here. I'm taking a little time off.
But next week, I'm going to be doing lots of interviews.
Are there going to be lecture quizzes for this and the following lectures?
Yes.
There will be lecture quizzes.
Because…
these are lectures and and you're
This is important material for you to learn and I'm not putting it on the final exam, but at least I can put a little quiz on it.
Code obfuscation can help, but it depends on what attacks you're trying to mitigate. Code obfuscation by itself.
It does certain things in it.
Yeah, it's a lot of problems code obfuscation does nothing for.
I'll send out email what it is, but if you want to volunteer
to sign up. Once I post additional time slots, just go ahead and add your name.
Anything else? Okay, but…
Otherwise, thank you very much and I will see you all
Next week.
The last few classes. Take care.