Security is hard. In 2019, keeping web applications secure is an incredibly difficult task, in the face of ever-increasing diversity of software security problems. The goal of this talk is to give developers hints and best practices for ensuring the security of their Odoo code and avoiding common pitfalls. Based on the famous OWASP Top 10, and a history of security trainings given in Odoo R&D, this presentation will attempt to cover the most common security bugs found in Odoo apps, describing how they work, their impact, and how to detect and fix them during code reviews. Prerequisites: some development experience, not necessarily in Odoo, but ideally in Python and/or Javascript. Most of the issues will be discussed on a high level, but there will also be a few specific code analysis examples.

1. Odoo CODE
HARDENING
One review at a time...
Olivier Dony - @odony
Defence Against Dark Arts :)
2019
EXPERIENCE

2. SECURITY MODEL

3. Security Model
Data
Access
Control
Apps / Business Logic

4. Security Model
RBAC = Groups + ACL + Rules
Roles
Data
Apps / Business Logic
Access
Control

5. Access Control is NOT implemented
in menu items
in screen definitions
in client-side Javascript
in secret methods

6. RISKS
TOP TEN

7. OWASP Top Ten - 2017
A1. Injection

8. OWASP Top Ten - 2017
A1. Injection
A2. Broken Authentication

9. OWASP Top Ten - 2017
A1. Injection
A2. Broken Authentication
A3. Sensitive Data Exposure

10. OWASP Top Ten - 2017
A1. Injection
A2. Broken Authentication
A3. Sensitive Data Exposure
A4. XXE

11. OWASP Top Ten - 2017
A1. Injection
A2. Broken Authentication
A3. Sensitive Data Exposure
A4. XXE
A5. Broken Access Cont. / IDOR

12. OWASP Top Ten - 2017
A6. Security Misconfiguration

13. OWASP Top Ten - 2017
A6. Security Misconfiguration
A7. XSS

14. OWASP Top Ten - 2017
A6. Security Misconfiguration
A7. XSS
A8. Insecure Deserialization

15. OWASP Top Ten - 2017
A6. Security Misconfiguration
A7. XSS
A8. Insecure Deserialization
A9. Vulnerable Components

16. OWASP Top Ten - 2017
A6. Security Misconfiguration
A7. XSS
A8. Insecure Deserialization
A9. Vulnerable Components
A10. Insufficient Logging

17. A5. BROKEN ACCESS CONTROL

18. A5. BROKEN ACCESS CONTROL / IDOR
#1
MISSING (OR INCORRECT) ACLs

19. A5. BROKEN ACCESS CONTROL / IDOR
NEW
MODEL
ACCESS
CONTROL LISTS
(per-role access)
RECORD RULES
(per-user filters)
FIELD
RESTRICTIONS
(sensitive data)

20. A5. BROKEN ACCESS CONTROL / IDOR
#2
WRONG sudo() USAGE
INSECURE ROUTES

21. A5. BROKEN ACCESS CONTROL / IDOR
CONVERTERS
CONVERTERS

22. A5. BROKEN ACCESS CONTROL / IDOR
CONVERTERS TYPE

23. A5. BROKEN ACCESS CONTROL / IDOR
CONVERTERS TYPE METHODS

24. A5. BROKEN ACCESS CONTROL / IDOR
CONVERTERS TYPE METHODS
AUTH
- user
- public
- none

25. A7. XSS

26. A7. XSS
STRING
FORMATTING
“<b>” + name
`<b>${name}</b>`
UNSAFE
DESERIALIZATION
eval()
VULNERABLE
TEMPLATES
t-raw
VULNERABLE LIB
$.popover()
FILES
.svg,.html
LINKS
javascript:
SO MANY WAYS
TO ATTACK YOUR
BROWSER!

27. A7. XSS
DATA/CODE CONFUSION IN
TWITTER BOOTSTRAP 4
(CVE-2019-8331)
https://jsbin.com/yihinuramu/1/edit?html,output
ONE MORE EXAMPLE:

28. A7. XSS
CAN YOU SPOT THE PROBLEM?
https://github.com/twbs/bootstrap/blob/master/js/src/tooltip/tooltip.js#L449-L459

29. A1. INJECTION

30. A1. INJECTION

31. A1. INJECTION

32. A1. INJECTION

33. A1. INJECTION

34. REVIEW
CHECKLIST

35. REVIEW
CHECKLIST
01
CONTROL ACCESS
Groups, ACLs, Rules and
Fields
02
VERIFY PERMISSIONS
sudo(), controllers, private
methods
03
CHECK TEMPLATES
t-raw, untrusted input escaped
04
SAFE EVAL
Eval only trusted input, iff
impossible to avoid
BLOCK INJECTIONS
05 Double-check manual SQL,
shell commands, etc.
XSS PREVENTION
06 DOM, Stored, Reflected, look
for the signs!

36. THANKS!
Do you have any questions?
security@odoo.com
@odony
CREDITS: Presentation made with icons by
FlatIcon. Font: Exo2
Related talks:
2018 “How to break Odoo’s Security”
https://odoo.com/r/A1l
2017 “Safer Odoo Code”
https://odoo.com/r/dbN