SlideShare a Scribd company logo

SAST for TYPO3 Extensions - How Static Code Analysis Can Improve Security

•
•
Oliver Hader
Oliver Hader

This document discusses using static application security testing (SAST) tools for TYPO3 extensions. It begins with an introduction of the speaker and an overview of SAST basics and context. Several SAST tools are then evaluated using a demo TYPO3 application, finding that PsalmPHP is most suitable due to its support for PHP features. Next, how PsalmPHP can be used for TYPO3 is explained through stubs, annotations, and a demo runner. Finally, future steps are outlined to improve support for additional TYPO3 components and integrate SAST into the extension review process.

Technology
1 of 37
Download to read offline
SAST für TYPO3 Extensions 
 #T3CRR21 #security Oliver Hader oliver@typo3.org @ohader TYPO3camp RheinRuhr 2021 6. November 2021
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 2 ▪Research & Development ▪TYPO3 Security Team Lead ▪50% TYPO3 GmbH / 50% Freelancer ▪#hof #cycling #paramedic #in.die.musik ~# whoami Oliver Hader @ohader
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 3 ▪Statische Code Analyse #basics ▪Orientierung im Security Bereich #context ▪Verwendung für TYPO3 #nähkästchen ▪MüssteMalJemand™ #zukunft Agenda
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 4 ▪ Bitte, bitte, bitte: Security Schwachstellen nicht öffentlich einstellen/diskutieren ▪ nicht auf GitHub/Forge ▪ nicht in Slack Channels ▪ nicht auf Twitter, Twitch, ... ▪ Meldung an security@typo3.org ▪ Security Team unterstützt Community Trigger Warning ⚠︎
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #basics Statische Code 
 Analyse 5
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 6 Statische Code Analyse - Schematischer Ablauf Statische Code Analyse https://www.grammatech.com/products/source-code-analysis
Abstract Syntax Tree (AST) ▪ Abstract Syntax Tree (AST) ▪ Composer Package 
 nikic/php-parser 7 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
Abstract Syntax Tree (AST) ▪ Abstract Syntax Tree (AST) ▪ Composer Package 
 nikic/php-parser 8 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
Statische Code Analyse in PHP ▪ basierend auf 
 Abstract Syntax Tree (AST) ▪ Extension Scanner in TYPO3 ▪ PhpStan - Core CI Builds ▪ Rector - TYPO3 Code Upgrade ▪ Psalm - Security Taint Graph 9 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #context 
 Orientierung im 
 Security Bereich 10
Ebenenmodell zur Sicherheitskonzeption (BSI) 11 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Webanwendungen/webanwendungen_node.html Auf Grundlage eines Ebenenmodells lassen sich die Zuständigkeiten der relevanten Organisationsbereiche den einzelnen Teilaufgaben bei Sicherheitskonzeption und Realisierung von Webanwendungen zuordnen. Ausgangspunkt ist eine Unterteilung in 5 Ebenen: Abbildung 1: Ebenenmodell Ebene Inhalt (Beispiele) 5 Semantik Schutz vor Täuschung und Betrug - Informationen ermöglichen Social Engineering-Angriffe - Gebrauch von Popups u.ä. erleichtern Phishing-Angriffe - Keine Absicherung für den Fall der Fälschung der Web­ site 4 Logik Absicherung von Prozessen und Workflows als Ganzes - Verwendung unsicherer Email in einem ansonsten gesi­ cherten Workflow - Angreifbarkeit des Passworts durch nachlässig gestaltete "Passwort vergessen"-Funktion - Die Verwendung sicherer Passworte wird nicht erzwun­ gen 3 Implementie­ rung Vermeiden von Programmierfehlern, die zu Schwachstellen führen - Cross-Site Scripting - SQL-Injection - Session Riding 2 Technologie Richtige Wahl und sicherer Einsatz von Technologie - unverschlüsselte Übertragung sensitiver Daten - Authentisierungsverfahren, die nicht dem Schutzbedarf angemessen sind - Ungenügende Randomness von Token 1 System Absicherung der auf der Systemplattform eingesetzten Software - Fehler in der Konfiguration des Webservers - "Known Vulnerabilities" in den eingesetzten Software­ produkten - Mangelnder Zugriffsschutz in der Datenbank 0 Netzwerk & Host Absicherung von Host und Netzwerk Sicherheit von Webanwendungen Maßnahmenkatalog und Best Practices Im Auftrag des Bundesamtes für Sicherheit in der Informationstechnik erstellt von: Version 1, August 2006 SAST #bugs #infrastructure #workflows #phishing #SocialEngineering
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Marktanalyse - Statische Code Analyse für TYPO3 12 ▪ SonarSource, SonarCloud, SonarCube ▪ RIPS Tech Scanner ▪ DeepCode.ai ▪ PsalmPHP https://github.com/ohader/sast-demo
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 13 Demo Anwendung (vereinfacht) https://github.com/ohader/sast-demo
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 14 Demo Anwendung (vereinfacht) https://github.com/ohader/sast-demo SQLi Benutzereingaben XSS
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 15 SonarCloud (SonarSource) → „Alles supi!“ #nicht SonarCloud
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 16 RIPS Tech Scanner → übernommen von SonarSource RIPS Tech Scanner UNRELATED! 
 ganz anderes Projekt
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 17 DeepCode.ai → übernommen von Snyk.io → Schwachstellen gefunden DeepCode.ai / Snyk.io
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 18 PsalmPHP (https://psalm.dev/r/159771bec7) → Schwachstellen gefunden PsalmPHP
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Marktanalyse - Statische Code Analyse für TYPO3 19 ▪ SonarSource, SonarCloud, SonarCube - nichts gefunden 😵 ▪ RIPS Tech Scanner - Schwachstellen vermutlich gefunden 🙄 ▪ im Mai 2020 von SonarSource übernommen ▪ DeepCode.ai - Schwachstellen gefunden 😅 ▪ im August 2020 von Snyk.io übernommen ▪ PsalmPHP - Schwachstellen gefunden 😅
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 20 Demo Anwendung (realistischer) https://github.com/ohader/sast-demo
Demo Anwendung (realistischer) ▪ TYPO3 ist speziell! ▪ fehlende Unterstützung für 
 Framework Komponenten ▪ PSR: Request/Response ▪ PSR: Dependency Injection ▪ Fluid: Templating Engine ▪ DBAL: Datenbank Schicht ▪ TYPO3: Hooks, TypoScript 21 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org SQLi Injection XSS
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #nähkästchen 
 Verwendung für TYPO3 22
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org SAST für TYPO3 mit PsalmPHP 23 ▪ PsalmPHP für TYPO3 ▪ Open-Source Project (MIT) ▪ Implementiert in PHP ▪ Erweiterbar durch Plugins ▪ unterstützt sources, sinks, 
 escapes, unescapes, flow https://github.com/vimeo/psalm
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 24 PsalmPHP Stubs ▪ @template ▪ liefert Instanz 
 von $className
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 25 PsalmPHP Stubs ▪ @psalm-taint-source ▪ Rückgabewerte sind 
 Benutzereingaben ▪ wie $_GET, $_POST, $_COOKIE, HTTP Header
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 26 PsalmPHP Stubs ▪ @psalm-taint-sink ▪ verwundbar in Aspekt sql, wenn Parameter $query aus unsicherer 
 @psalm-taint-source
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 27 PsalmPHP Stubs ▪ @psalm-taint-escape ▪ markiert Parameter $str für Aspekt sql als bereinigt ▪ @psalm-taint-unescape ▪ … das Gegenteil (unsicher)
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 28 typo3-security/psalm-plugin - nicht öffentlich TYPO3 Plugin für PsalmPHP
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 29 Kompakte Ausgabe Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 30 Ausführlichere Ausgabe Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 31 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 32 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 33 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #zukunft 
 MüssteMalJemand™ 34
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Nächste Schritte 35 ▪ Erweiterung der Stub-Deklarationen (Hooks, Fluid, TypoScript) ▪ Erweiterung für bekannte/bereinigte Verwundbarkeiten ▪ Infrastruktur & Queue für regelmäßige Extension Scans ▪ Freigabe für (echte) Extension Maintainer & Integration in TER ▪ (mögliche Fundstellen müssen natürlich auch bereinigt werden)
TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Nächste Schritte 36 ▪ TYPO3 Psalm-Plugin & Psalm-Runner vorerst nicht öffentlich ▪ evtl. Public-Beta über Verified Extensions (@VolkerGraubaum) ▪ Entwicklung wird durch TYPO3 Association finanziert ▪ Interessierte/Supporter bitte unter security@typo3.org melden
thanks! questions? 37

Recommended

Hacking TYPO3 v9
Hacking TYPO3 v9Hacking TYPO3 v9
Hacking TYPO3 v9Oliver Hader
 
Hacking TYPO3 v9 (T3DD19 edition)
Hacking TYPO3 v9 (T3DD19 edition)Hacking TYPO3 v9 (T3DD19 edition)
Hacking TYPO3 v9 (T3DD19 edition)Oliver Hader
 
Web Application Security Workshop (T3DD19)
Web Application Security Workshop (T3DD19)Web Application Security Workshop (T3DD19)
Web Application Security Workshop (T3DD19)Oliver Hader
 
H4CK1N6 - Web Application Security
H4CK1N6 - Web Application SecurityH4CK1N6 - Web Application Security
H4CK1N6 - Web Application SecurityOliver Hader
 
TYPO3 Backstage Development
TYPO3 Backstage DevelopmentTYPO3 Backstage Development
TYPO3 Backstage DevelopmentOliver Hader
 
TYPO3 Event Sourcing
TYPO3 Event SourcingTYPO3 Event Sourcing
TYPO3 Event SourcingOliver Hader
 
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...Frans Rosén
 
Standardizing and Strengthening Security to Lower Costs
Standardizing and Strengthening Security to Lower CostsStandardizing and Strengthening Security to Lower Costs
Standardizing and Strengthening Security to Lower CostsOpenDNS
 

Recommended

Hacking TYPO3 v9
Hacking TYPO3 v9Hacking TYPO3 v9
Hacking TYPO3 v9Oliver Hader
 
Hacking TYPO3 v9 (T3DD19 edition)
Hacking TYPO3 v9 (T3DD19 edition)Hacking TYPO3 v9 (T3DD19 edition)
Hacking TYPO3 v9 (T3DD19 edition)Oliver Hader
 
Web Application Security Workshop (T3DD19)
Web Application Security Workshop (T3DD19)Web Application Security Workshop (T3DD19)
Web Application Security Workshop (T3DD19)Oliver Hader
 
H4CK1N6 - Web Application Security
H4CK1N6 - Web Application SecurityH4CK1N6 - Web Application Security
H4CK1N6 - Web Application SecurityOliver Hader
 
TYPO3 Backstage Development
TYPO3 Backstage DevelopmentTYPO3 Backstage Development
TYPO3 Backstage DevelopmentOliver Hader
 
TYPO3 Event Sourcing
TYPO3 Event SourcingTYPO3 Event Sourcing
TYPO3 Event SourcingOliver Hader
 
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...Frans Rosén
 
Standardizing and Strengthening Security to Lower Costs
Standardizing and Strengthening Security to Lower CostsStandardizing and Strengthening Security to Lower Costs
Standardizing and Strengthening Security to Lower CostsOpenDNS
 
Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018SecuRing
 
CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014Greg Foss
 
Paolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligencePaolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligenceCodemotion
 
Building & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsBuilding & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsSecuRing
 
Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Brandon McCrillis
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareThomas Roccia
 
Building&Hacking modern iOS apps
Building&Hacking modern iOS appsBuilding&Hacking modern iOS apps
Building&Hacking modern iOS appsSecuRing
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Mobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceMobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceNowSecure
 
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspectiveSecuRing
 
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green North Texas Chapter of the ISSA
 
Magento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEMagento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEAnna Völkl
 
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...North Texas Chapter of the ISSA
 
Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Greg Foss
 
T3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsT3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsOliver Hader
 
Top 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPTop 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPERPScan
 
Beyond Web Interfaces
Beyond Web InterfacesBeyond Web Interfaces
Beyond Web Interfacesciacchi
 
Architecting next generation big data platform
Architecting next generation big data platformArchitecting next generation big data platform
Architecting next generation big data platformhadooparchbook
 
PyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application securePyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application secureIMMUNIO
 
MLSEC 2020
MLSEC 2020MLSEC 2020
MLSEC 2020Zoltan Balazs
 
RIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombRIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombPriyanka Aash
 
Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Frédéric Harper
 

More Related Content

What's hot

Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018SecuRing
 
CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014Greg Foss
 
Paolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligencePaolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligenceCodemotion
 
Building & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsBuilding & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsSecuRing
 
Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Brandon McCrillis
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareThomas Roccia
 
Building&Hacking modern iOS apps
Building&Hacking modern iOS appsBuilding&Hacking modern iOS apps
Building&Hacking modern iOS appsSecuRing
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC IdentityMarc Littlemore
 
Mobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceMobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceNowSecure
 
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspectiveSecuRing
 
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green North Texas Chapter of the ISSA
 
Magento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEMagento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEAnna Völkl
 
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...North Texas Chapter of the ISSA
 
Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Greg Foss
 

What's hot (14)

Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018Testing iOS apps without jailbreak in 2018
Testing iOS apps without jailbreak in 2018
 
CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014CMS Hacking Tricks - DerbyCon 4 - 2014
CMS Hacking Tricks - DerbyCon 4 - 2014
 
Paolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat IntelligencePaolo Passeri - A Multi Layered Approach to Threat Intelligence
Paolo Passeri - A Multi Layered Approach to Threat Intelligence
 
Building & Hacking Modern iOS Apps
Building & Hacking Modern iOS AppsBuilding & Hacking Modern iOS Apps
Building & Hacking Modern iOS Apps
 
Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?Internet of Terrible: Can you hear me meow?
Internet of Terrible: Can you hear me meow?
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS Malware
 
Building&Hacking modern iOS apps
Building&Hacking modern iOS appsBuilding&Hacking modern iOS apps
Building&Hacking modern iOS apps
 
Securing Your BBC Identity
Securing Your BBC IdentitySecuring Your BBC Identity
Securing Your BBC Identity
 
Mobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic MenaceMobile Penetration Testing: Episode 1 - The Forensic Menace
Mobile Penetration Testing: Episode 1 - The Forensic Menace
 
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspective
 
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
Networking 2016-05-24 - Topic 1- Cybereason Lab Analysis by Brad Green
 
Magento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DEMagento Security Best Practises - MM17DE
Magento Security Best Practises - MM17DE
 
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
Networking 2016-05-24 - Topic 2 - The "Hack Back" - How Hacking Team Became t...
 
Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016Deception Driven Defense - Infragard 2016
Deception Driven Defense - Infragard 2016
 

Similar to SAST for TYPO3 Extensions - How Static Code Analysis Can Improve Security

T3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsT3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsOliver Hader
 
Top 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPTop 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPERPScan
 
Beyond Web Interfaces
Beyond Web InterfacesBeyond Web Interfaces
Beyond Web Interfacesciacchi
 
Architecting next generation big data platform
Architecting next generation big data platformArchitecting next generation big data platform
Architecting next generation big data platformhadooparchbook
 
PyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application securePyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application secureIMMUNIO
 
RIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombRIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombPriyanka Aash
 
Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Frédéric Harper
 
Practical SAP pentesting workshop (NullCon Goa)
Practical SAP pentesting workshop (NullCon Goa)Practical SAP pentesting workshop (NullCon Goa)
Practical SAP pentesting workshop (NullCon Goa)ERPScan
 
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...Landon Robinson
 
technical-information-gathering-slides.pdf
technical-information-gathering-slides.pdftechnical-information-gathering-slides.pdf
technical-information-gathering-slides.pdfMarceloCunha571649
 
Automotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerAutomotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerForAllSecure
 
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試Secview
 
Practical SAP pentesting (B-Sides San Paulo)
Practical SAP pentesting (B-Sides San Paulo)Practical SAP pentesting (B-Sides San Paulo)
Practical SAP pentesting (B-Sides San Paulo)ERPScan
 
Apache Spark Listeners: A Crash Course in Fast, Easy Monitoring
Apache Spark Listeners: A Crash Course in Fast, Easy MonitoringApache Spark Listeners: A Crash Course in Fast, Easy Monitoring
Apache Spark Listeners: A Crash Course in Fast, Easy MonitoringDatabricks
 
Architecture vulnerabilities in SAP platforms
Architecture vulnerabilities in SAP platformsArchitecture vulnerabilities in SAP platforms
Architecture vulnerabilities in SAP platformsERPScan
 
2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open StandardsAPIsecure_ Official
 
SAP Forensics Detecting White Collar Cyber-crime
SAP Forensics Detecting White Collar Cyber-crimeSAP Forensics Detecting White Collar Cyber-crime
SAP Forensics Detecting White Collar Cyber-crimeOnapsis Inc.
 
Serverless survival kit
Serverless survival kitServerless survival kit
Serverless survival kitSteve Houël
 

Similar to SAST for TYPO3 Extensions - How Static Code Analysis Can Improve Security (20)

T3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & PitfallsT3DD23 Content Security Policy - Concept, Strategies & Pitfalls
T3DD23 Content Security Policy - Concept, Strategies & Pitfalls
 
Top 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAPTop 10 most interesting vulnerabilities and attacks in SAP
Top 10 most interesting vulnerabilities and attacks in SAP
 
Beyond Web Interfaces
Beyond Web InterfacesBeyond Web Interfaces
Beyond Web Interfaces
 
Architecting next generation big data platform
Architecting next generation big data platformArchitecting next generation big data platform
Architecting next generation big data platform
 
PyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application securePyCon Canada 2015 - Is your python application secure
PyCon Canada 2015 - Is your python application secure
 
MLSEC 2020
MLSEC 2020MLSEC 2020
MLSEC 2020
 
RIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombRIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob Holcomb
 
Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07Is your python application secure? - PyCon Canada - 2015-11-07
Is your python application secure? - PyCon Canada - 2015-11-07
 
Practical SAP pentesting workshop (NullCon Goa)
Practical SAP pentesting workshop (NullCon Goa)Practical SAP pentesting workshop (NullCon Goa)
Practical SAP pentesting workshop (NullCon Goa)
 
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
Spark + AI Summit 2019: Apache Spark Listeners: A Crash Course in Fast, Easy ...
 
Origins of Serverless
Origins of ServerlessOrigins of Serverless
Origins of Serverless
 
technical-information-gathering-slides.pdf
technical-information-gathering-slides.pdftechnical-information-gathering-slides.pdf
technical-information-gathering-slides.pdf
 
Automotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerAutomotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a Hacker
 
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
HITCON Defense Summit 2019 － 從 SAST 談持續式資安測試
 
Practical SAP pentesting (B-Sides San Paulo)
Practical SAP pentesting (B-Sides San Paulo)Practical SAP pentesting (B-Sides San Paulo)
Practical SAP pentesting (B-Sides San Paulo)
 
Apache Spark Listeners: A Crash Course in Fast, Easy Monitoring
Apache Spark Listeners: A Crash Course in Fast, Easy MonitoringApache Spark Listeners: A Crash Course in Fast, Easy Monitoring
Apache Spark Listeners: A Crash Course in Fast, Easy Monitoring
 
Architecture vulnerabilities in SAP platforms
Architecture vulnerabilities in SAP platformsArchitecture vulnerabilities in SAP platforms
Architecture vulnerabilities in SAP platforms
 
2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards
 
SAP Forensics Detecting White Collar Cyber-crime
SAP Forensics Detecting White Collar Cyber-crimeSAP Forensics Detecting White Collar Cyber-crime
SAP Forensics Detecting White Collar Cyber-crime
 
Serverless survival kit
Serverless survival kitServerless survival kit
Serverless survival kit
 

More from Oliver Hader

TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"Oliver Hader
 
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)Oliver Hader
 
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...Oliver Hader
 
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJSWebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJSOliver Hader
 
Web application security
Web application securityWeb application security
Web application securityOliver Hader
 
Contribute to TYPO3 CMS
Contribute to TYPO3 CMSContribute to TYPO3 CMS
Contribute to TYPO3 CMSOliver Hader
 
T3CON13DE - TYPO3 CMS Team
T3CON13DE - TYPO3 CMS TeamT3CON13DE - TYPO3 CMS Team
T3CON13DE - TYPO3 CMS TeamOliver Hader
 
TYPO3camp Regensburg: TYPO3 6.0
TYPO3camp Regensburg: TYPO3 6.0TYPO3camp Regensburg: TYPO3 6.0
TYPO3camp Regensburg: TYPO3 6.0Oliver Hader
 
TYPO3 Inline Relational Record Editing (IRRE)
TYPO3 Inline Relational Record Editing (IRRE)TYPO3 Inline Relational Record Editing (IRRE)
TYPO3 Inline Relational Record Editing (IRRE)Oliver Hader
 
TYPO3 4.6 & TYPO3 4.7
TYPO3 4.6 & TYPO3 4.7TYPO3 4.6 & TYPO3 4.7
TYPO3 4.6 & TYPO3 4.7Oliver Hader
 

More from Oliver Hader (11)

TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
TYPO3camp Munich 2018 - Keynote - "Wo woll'n mer denn hin?"
 
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
TYPO3 CMS - Datenmodifikation & Event Sourcing (Masterarbeit)
 
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
Vor- und Nachteile von Web Components mit Polymer gegenüber AngularJS ohne P...
 
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJSWebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
WebGL - 3D im Browser - Erfahrungsbericht mit BabylonJS
 
Web Components
Web ComponentsWeb Components
Web Components
 
Web application security
Web application securityWeb application security
Web application security
 
Contribute to TYPO3 CMS
Contribute to TYPO3 CMSContribute to TYPO3 CMS
Contribute to TYPO3 CMS
 
T3CON13DE - TYPO3 CMS Team
T3CON13DE - TYPO3 CMS TeamT3CON13DE - TYPO3 CMS Team
T3CON13DE - TYPO3 CMS Team
 
TYPO3camp Regensburg: TYPO3 6.0
TYPO3camp Regensburg: TYPO3 6.0TYPO3camp Regensburg: TYPO3 6.0
TYPO3camp Regensburg: TYPO3 6.0
 
TYPO3 Inline Relational Record Editing (IRRE)
TYPO3 Inline Relational Record Editing (IRRE)TYPO3 Inline Relational Record Editing (IRRE)
TYPO3 Inline Relational Record Editing (IRRE)
 
TYPO3 4.6 & TYPO3 4.7
TYPO3 4.6 & TYPO3 4.7TYPO3 4.6 & TYPO3 4.7
TYPO3 4.6 & TYPO3 4.7
 

Recently uploaded

GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticscarlostorres15106
 
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...HostedbyConfluent
 
Key Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxKey Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxLBM Solutions
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
How to Remove Document Management Hurdles with X-Docs?
How to Remove Document Management Hurdles with X-Docs?How to Remove Document Management Hurdles with X-Docs?
How to Remove Document Management Hurdles with X-Docs?XfilesPro
 
Snow Chain-Integrated Tire for a Safe Drive on Winter Roads
Snow Chain-Integrated Tire for a Safe Drive on Winter RoadsSnow Chain-Integrated Tire for a Safe Drive on Winter Roads
Snow Chain-Integrated Tire for a Safe Drive on Winter RoadsHyundai Motor Group
 
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your BudgetHyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your BudgetEnjoy Anytime
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersThousandEyes
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 3652toLead Limited
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
Next-generation AAM aircraft unveiled by Supernal, S-A2
Next-generation AAM aircraft unveiled by Supernal, S-A2Next-generation AAM aircraft unveiled by Supernal, S-A2
Next-generation AAM aircraft unveiled by Supernal, S-A2Hyundai Motor Group
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreternaman860154
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Alan Dix
 
Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitecturePixlogix Infotech
 

Recently uploaded (20)

The transition to renewables in India.pdf
The transition to renewables in India.pdfThe transition to renewables in India.pdf
The transition to renewables in India.pdf
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
 
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
 
Key Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxKey Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptx
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
How to Remove Document Management Hurdles with X-Docs?
How to Remove Document Management Hurdles with X-Docs?How to Remove Document Management Hurdles with X-Docs?
How to Remove Document Management Hurdles with X-Docs?
 
Snow Chain-Integrated Tire for a Safe Drive on Winter Roads
Snow Chain-Integrated Tire for a Safe Drive on Winter RoadsSnow Chain-Integrated Tire for a Safe Drive on Winter Roads
Snow Chain-Integrated Tire for a Safe Drive on Winter Roads
 
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your BudgetHyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
Next-generation AAM aircraft unveiled by Supernal, S-A2
Next-generation AAM aircraft unveiled by Supernal, S-A2Next-generation AAM aircraft unveiled by Supernal, S-A2
Next-generation AAM aircraft unveiled by Supernal, S-A2
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
 
Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC Architecture
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 

SAST for TYPO3 Extensions - How Static Code Analysis Can Improve Security

  • 1. SAST für TYPO3 Extensions 
 #T3CRR21 #security Oliver Hader oliver@typo3.org @ohader TYPO3camp RheinRuhr 2021 6. November 2021
  • 2. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 2 ▪Research & Development ▪TYPO3 Security Team Lead ▪50% TYPO3 GmbH / 50% Freelancer ▪#hof #cycling #paramedic #in.die.musik ~# whoami Oliver Hader @ohader
  • 3. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 3 ▪Statische Code Analyse #basics ▪Orientierung im Security Bereich #context ▪Verwendung für TYPO3 #nähkästchen ▪MüssteMalJemand™ #zukunft Agenda
  • 4. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 4 ▪ Bitte, bitte, bitte: Security Schwachstellen nicht öffentlich einstellen/diskutieren ▪ nicht auf GitHub/Forge ▪ nicht in Slack Channels ▪ nicht auf Twitter, Twitch, ... ▪ Meldung an security@typo3.org ▪ Security Team unterstützt Community Trigger Warning ⚠︎
  • 5. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #basics Statische Code 
 Analyse 5
  • 6. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 6 Statische Code Analyse - Schematischer Ablauf Statische Code Analyse https://www.grammatech.com/products/source-code-analysis
  • 7. Abstract Syntax Tree (AST) ▪ Abstract Syntax Tree (AST) ▪ Composer Package 
 nikic/php-parser 7 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
  • 8. Abstract Syntax Tree (AST) ▪ Abstract Syntax Tree (AST) ▪ Composer Package 
 nikic/php-parser 8 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
  • 9. Statische Code Analyse in PHP ▪ basierend auf 
 Abstract Syntax Tree (AST) ▪ Extension Scanner in TYPO3 ▪ PhpStan - Core CI Builds ▪ Rector - TYPO3 Code Upgrade ▪ Psalm - Security Taint Graph 9 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org
  • 10. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #context 
 Orientierung im 
 Security Bereich 10
  • 11. Ebenenmodell zur Sicherheitskonzeption (BSI) 11 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Webanwendungen/webanwendungen_node.html Auf Grundlage eines Ebenenmodells lassen sich die Zuständigkeiten der relevanten Organisationsbereiche den einzelnen Teilaufgaben bei Sicherheitskonzeption und Realisierung von Webanwendungen zuordnen. Ausgangspunkt ist eine Unterteilung in 5 Ebenen: Abbildung 1: Ebenenmodell Ebene Inhalt (Beispiele) 5 Semantik Schutz vor Täuschung und Betrug - Informationen ermöglichen Social Engineering-Angriffe - Gebrauch von Popups u.ä. erleichtern Phishing-Angriffe - Keine Absicherung für den Fall der Fälschung der Web­ site 4 Logik Absicherung von Prozessen und Workflows als Ganzes - Verwendung unsicherer Email in einem ansonsten gesi­ cherten Workflow - Angreifbarkeit des Passworts durch nachlässig gestaltete "Passwort vergessen"-Funktion - Die Verwendung sicherer Passworte wird nicht erzwun­ gen 3 Implementie­ rung Vermeiden von Programmierfehlern, die zu Schwachstellen führen - Cross-Site Scripting - SQL-Injection - Session Riding 2 Technologie Richtige Wahl und sicherer Einsatz von Technologie - unverschlüsselte Übertragung sensitiver Daten - Authentisierungsverfahren, die nicht dem Schutzbedarf angemessen sind - Ungenügende Randomness von Token 1 System Absicherung der auf der Systemplattform eingesetzten Software - Fehler in der Konfiguration des Webservers - "Known Vulnerabilities" in den eingesetzten Software­ produkten - Mangelnder Zugriffsschutz in der Datenbank 0 Netzwerk & Host Absicherung von Host und Netzwerk Sicherheit von Webanwendungen Maßnahmenkatalog und Best Practices Im Auftrag des Bundesamtes für Sicherheit in der Informationstechnik erstellt von: Version 1, August 2006 SAST #bugs #infrastructure #workflows #phishing #SocialEngineering
  • 12. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Marktanalyse - Statische Code Analyse für TYPO3 12 ▪ SonarSource, SonarCloud, SonarCube ▪ RIPS Tech Scanner ▪ DeepCode.ai ▪ PsalmPHP https://github.com/ohader/sast-demo
  • 13. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 13 Demo Anwendung (vereinfacht) https://github.com/ohader/sast-demo
  • 14. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 14 Demo Anwendung (vereinfacht) https://github.com/ohader/sast-demo SQLi Benutzereingaben XSS
  • 15. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 15 SonarCloud (SonarSource) → „Alles supi!“ #nicht SonarCloud
  • 16. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 16 RIPS Tech Scanner → übernommen von SonarSource RIPS Tech Scanner UNRELATED! 
 ganz anderes Projekt
  • 17. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 17 DeepCode.ai → übernommen von Snyk.io → Schwachstellen gefunden DeepCode.ai / Snyk.io
  • 18. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 18 PsalmPHP (https://psalm.dev/r/159771bec7) → Schwachstellen gefunden PsalmPHP
  • 19. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Marktanalyse - Statische Code Analyse für TYPO3 19 ▪ SonarSource, SonarCloud, SonarCube - nichts gefunden 😵 ▪ RIPS Tech Scanner - Schwachstellen vermutlich gefunden 🙄 ▪ im Mai 2020 von SonarSource übernommen ▪ DeepCode.ai - Schwachstellen gefunden 😅 ▪ im August 2020 von Snyk.io übernommen ▪ PsalmPHP - Schwachstellen gefunden 😅
  • 20. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 20 Demo Anwendung (realistischer) https://github.com/ohader/sast-demo
  • 21. Demo Anwendung (realistischer) ▪ TYPO3 ist speziell! ▪ fehlende Unterstützung für 
 Framework Komponenten ▪ PSR: Request/Response ▪ PSR: Dependency Injection ▪ Fluid: Templating Engine ▪ DBAL: Datenbank Schicht ▪ TYPO3: Hooks, TypoScript 21 TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org SQLi Injection XSS
  • 22. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #nähkästchen 
 Verwendung für TYPO3 22
  • 23. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org SAST für TYPO3 mit PsalmPHP 23 ▪ PsalmPHP für TYPO3 ▪ Open-Source Project (MIT) ▪ Implementiert in PHP ▪ Erweiterbar durch Plugins ▪ unterstützt sources, sinks, 
 escapes, unescapes, flow https://github.com/vimeo/psalm
  • 24. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 24 PsalmPHP Stubs ▪ @template ▪ liefert Instanz 
 von $className
  • 25. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 25 PsalmPHP Stubs ▪ @psalm-taint-source ▪ Rückgabewerte sind 
 Benutzereingaben ▪ wie $_GET, $_POST, $_COOKIE, HTTP Header
  • 26. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 26 PsalmPHP Stubs ▪ @psalm-taint-sink ▪ verwundbar in Aspekt sql, wenn Parameter $query aus unsicherer 
 @psalm-taint-source
  • 27. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 27 PsalmPHP Stubs ▪ @psalm-taint-escape ▪ markiert Parameter $str für Aspekt sql als bereinigt ▪ @psalm-taint-unescape ▪ … das Gegenteil (unsicher)
  • 28. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 28 typo3-security/psalm-plugin - nicht öffentlich TYPO3 Plugin für PsalmPHP
  • 29. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 29 Kompakte Ausgabe Demo TYPO3 Psalm-Runner
  • 30. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 30 Ausführlichere Ausgabe Demo TYPO3 Psalm-Runner
  • 31. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 31 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
  • 32. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 32 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
  • 33. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org 33 SARIF Export & GitHub Integration Demo TYPO3 Psalm-Runner
  • 34. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org #zukunft 
 MüssteMalJemand™ 34
  • 35. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Nächste Schritte 35 ▪ Erweiterung der Stub-Deklarationen (Hooks, Fluid, TypoScript) ▪ Erweiterung für bekannte/bereinigte Verwundbarkeiten ▪ Infrastruktur & Queue für regelmäßige Extension Scans ▪ Freigabe für (echte) Extension Maintainer & Integration in TER ▪ (mögliche Fundstellen müssen natürlich auch bereinigt werden)
  • 36. TYPO3camp RheinRuhr 2021 - SAST für TYPO3 Extensions - oliver.hader@typo3.org Nächste Schritte 36 ▪ TYPO3 Psalm-Plugin & Psalm-Runner vorerst nicht öffentlich ▪ evtl. Public-Beta über Verified Extensions (@VolkerGraubaum) ▪ Entwicklung wird durch TYPO3 Association finanziert ▪ Interessierte/Supporter bitte unter security@typo3.org melden