[{"data":1,"prerenderedAt":131},["ShallowReactive",2],{"i-lucide:menu":3,"i-lucide:arrow-up-right":8,"i-lucide:moon":10,"i-lucide:sun":12,"i-lucide:rss":14,"i-simple-icons:github":16,"i-simple-icons:linkedin":18,"post-\u002F2011\u002Ftime-and-cost-in-favor-of-security":21,"surround-\u002F2011\u002Ftime-and-cost-in-favor-of-security":118,"i-lucide:arrow-left":127,"i-lucide:arrow-right":129},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M7 7h10v10M7 17L17 7\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M20.985 12.486a9 9 0 1 1-9.473-9.472c.405-.022.617.46.402.803a6 6 0 0 0 8.268 8.268c.344-.215.825-.004.803.401\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"12\" cy=\"12\" r=\"4\"\u002F>\u003Cpath d=\"M12 2v2m0 16v2M4.93 4.93l1.41 1.41m11.32 11.32l1.41 1.41M2 12h2m16 0h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M4 11a9 9 0 0 1 9 9M4 4a16 16 0 0 1 16 16\"\u002F>\u003Ccircle cx=\"5\" cy=\"19\" r=\"1\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19,"hidden":20},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"id":22,"title":23,"body":24,"category":101,"comments":102,"date":103,"description":30,"excerpt":102,"extension":104,"image":102,"meta":105,"navigation":20,"path":106,"readingTime":107,"seo":108,"stem":109,"subtitle":102,"tags":110,"wordCount":116,"__hash__":117},"posts\u002F2011\u002Ftime-and-cost-in-favor-of-security.md","Time and Cost in Favor Of Security",{"type":25,"value":26,"toc":98},"minimark",[27,31,34,37,40,45,48,59,67,70,73,79,82,91],[28,29,30],"p",{},"Beginners dilemma: do it properly and actually learn something new or do it so it gets done fast. Never mind the flexibility, security and the feelings of future developers as long as the task at hand gets done with minimal time consumption and makes one look like a pro, for the moment.",[28,32,33],{},"That kind of attitude reminds me a mix of The Office and The Simpsons. Yes - you can hack together something that barely manages to fulfill the current requirements... but then someone exploits the broken system or it collapses because a change in the environment or another developer has to do it over again, maybe from his own spare time because the business side can't justify the time spent on refactoring a kind-of working system.",[28,35,36],{},"I'm in full agreement that we (the developers) can't follow the golden rules all the time in the real world and compromises must be made to lower the costs... and then I wonder what the clients would say if the company told them point-blank from where the money is\u002Fwas saved. The fact that the developers think the website\u002Fapp will never be under any sort of attack, trust the user to input the right kind of data or guard their cookies is naive.",[28,38,39],{},"A situation like that is even more passionate when the team is split: one of the developers believes and is willing to do extra work to have some confidence in his creation, the other just does like it's always been done.",[41,42,44],"h1",{"id":43},"a-real-world-example","A Real-world Example",[28,46,47],{},"Imagine now that you had to set up a WYSIWYG editor with file upload capability - like CKEditor. CKEditor has 2 crucial parts for the server-side. One is the config file, the other the actual (PHP) uploader script. Below is a section of the config.php file.",[49,50,55],"pre",{"className":51,"code":53,"language":54},[52],"language-text","\u002F**\n * This function must check the user session to be sure that he\u002Fshe is\n * authorized to upload and access files in the File Browser.\n *\n * @return boolean\n *\u002F\nfunction CheckAuthentication()\n{\n    \u002F\u002F WARNING : DO NOT simply return \"true\". By doing so, you are allowing\n    \u002F\u002F \"anyone\" to upload and list the files in your server. You must implement\n    \u002F\u002F some kind of session validation here. Even something very simple as...\n\n    \u002F\u002F return isset($_SESSION['IsAuthorized']) && $_SESSION['IsAuthorized'];\n\n    \u002F\u002F ... where $_SESSION['IsAuthorized'] is set to \"true\" as soon as the\n    \u002F\u002F user logs in your system. To be able to use session variables don't\n    \u002F\u002F forget to add session_start() at the top of this file.\n\n    return false;\n\n}\n","text",[56,57,53],"code",{"__ignoreMap":58},"",[28,60,61,62,66],{},"As you can see, CKEdit doesn't really do anything until true is returned from the ",[63,64,65],"em",{},"CheckAuthentication()"," function. It's really tempting to do just that and skip the whole auth-thing to win those crucial minutes. The red (figuratively) warnings above don't really mean anything because surely, who'd ever want to attack our site OR who'd ever think to exploit the file upload script? We have one login page in front of the uploading script anyway.",[28,68,69],{},"Yeah. So what really happens is that the user doesn't notice anything unless (s)he has some technical knowledge and knows what to look for: an unprotected HTML page that accepts POST data. You've solved the current situation and don't want to go back to deal with the problem. The customer is (wrongly) happy and you get paid.",[28,71,72],{},"You should never neglect the most basic security to win time - not on anything that eventually ends up in production. The problem above would be solved by including the framework\u002Fcode that manages the main site and calling the auth check function. On Kohana 3 it would look like this:",[49,74,77],{"className":75,"code":76,"language":54},[52],"define('SUPPRESS_REQUEST', TRUE);\nrequire('..\u002F..\u002Findex.php');\nreturn Auth::instance()->logged_in();\n",[56,78,76],{"__ignoreMap":58},[28,80,81],{},"Done! Problem solved. Did it really take that long? Assuming you knew something about Kohana and it's modules.",[28,83,84,85,90],{},"If no-one specifically forbids you from thinking about security, ",[86,87,89],"span",{"style":88},"text-decoration: underline","do"," think about it. If you're not allowed to write code you're confident in, tell the managers they get what they pay for or find a new job.",[28,92,93],{},[94,95],"img",{"alt":96,"src":97},"CKeditor","\u002Fcontent\u002F2011\u002F09\u002Fcksec.png",{"title":58,"searchDepth":99,"depth":99,"links":100},2,[],"Software Development",null,"2011-09-26","md",{},"\u002F2011\u002Ftime-and-cost-in-favor-of-security","about 3 minutes",{"title":23,"description":30},"2011\u002Ftime-and-cost-in-favor-of-security",[111,112,113,114,115],"html","php","security","kohana","practices",667,"7qwcUG69b082Qh5ip1iW6J7MXFkWGIuvytX2ufgb9fw",[119,123],{"title":120,"path":121,"stem":122,"children":-1},"Vaata Maailma: Uus Algus","\u002F2011\u002Fvaata-maailma-uus-algus","2011\u002Fvaata-maailma-uus-algus",{"title":124,"path":125,"stem":126,"children":-1},"Microsoft TechDay 2011 Estonia","\u002F2011\u002Fmicrosoft-techday-2011-estonia","2011\u002Fmicrosoft-techday-2011-estonia",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":128},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":130},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14m-7-7l7 7l-7 7\"\u002F>",1790886934243]