View source for Security for developers/nan

<languages/>
{{Security sidebar}}
{{Development guideline}}
[[File:MediaWiki Security.ogv|thumb|300px|<span lang="en" dir="ltr" class="mw-content-ltr">Presentation by Wikimedia Foundation Security Engineer Chris Steipp from the [[Special:MyLanguage/Wikimedia Engineering/WMF Tech Days 2012|WMF Tech Days 2012]]</span>]]

'''<span lang="en" dir="ltr" class="mw-content-ltr">As a MediaWiki developer, you have a responsibility to write secure code in a style that is easy to review and audit.</span>'''
<span lang="en" dir="ltr" class="mw-content-ltr">This article focuses on the issues related to security and on the best practices used by MediaWiki developers to address these security issues.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">For issues of coding style, please read the MediaWiki [[Special:MyLanguage/Manual:coding conventions|coding conventions]].</span>

<span lang="en" dir="ltr" class="mw-content-ltr">'''Every MediaWiki developer''' should carefully read this article, regardless of their level of experience in web application development and with PHP, and periodically re-familiarise themselves with this material.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Additionally, every developer should carefully read the articles on [[Special:MyLanguage/Cross-site scripting|Cross-site scripting (XSS)]], [[Special:MyLanguage/Cross-site request forgery|Cross-site request forgery (CSRF)]], and {{ll|SQL injection}}, which each provide more detailed explanations of each of these common vulnerability types.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">The {{ll|security checklist for developers}} provides a useful reference for common development tasks.</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
==Why security matters==
</div>
<!--
The current section focuses on one small aspect of web application security as it relates to MediaWiki. Perhaps we should give a broader perspective?  We're not just worried about people rooting servers, we're also worried about data integrity, confidentiality, data provenance, etc. -- User:Zakgreant
-->
<span lang="en" dir="ltr" class="mw-content-ltr">Web application security is a critical issue in the wired world.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Websites with security vulnerabilities are a key part of the illicit global infrastructure of malware, spam and phishing.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">[[w:Bot_herder | Bot herders]] crawl the web looking for websites with security vulnerabilities, and then use the vulnerabilities to hijack them.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">The hijacked website will distribute malware (viruses) to visitors, either via browser vulnerabilities or overtly by social engineering.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">The downloaded malware turns the client's computer into a "zombie" that is part of a global network of organised crime aimed at stealing bank account details, sending spam, and extorting money from websites with denial-of-service threats.</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
==Demonstrable security==
</div>
<span lang="en" dir="ltr" class="mw-content-ltr">It's not enough to assure yourself that you are perfect and that your code has no security vulnerabilities.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Everyone makes mistakes.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">All MediaWiki core code, and a good deal of MediaWiki extensions code, is reviewed by experienced developers to verify its security.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">This is a good practice and should be encouraged.</span>

<span lang="en" dir="ltr" class="mw-content-ltr">Write code in such a way that it is '''demonstrably secure''', such that a reviewer can more easily tell that it's secure.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Don't write code that looks suspicious but is, on careful examination, secure.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Such code causes unnecessary '''reviewer anxiety'''.</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
==Overview of security vulnerabilities and attacks==
</div>
<span lang="en" dir="ltr" class="mw-content-ltr">This document has a strong focus on the following attacks and security risks.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Each MediaWiki developer should be familiar with these issues and have at least a passing understanding of them.</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== Cross-site scripting (XSS) ===
</div>
<span lang="en" dir="ltr" class="mw-content-ltr">''For detailed information on avoiding XSS vulnerabilities in MediaWiki, read the [[Special:MyLanguage/Cross-site scripting|Cross-site scripting]] article.''</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Cross-site scripting (XSS) vulnerabilities allow an attacker to inject malicious code into a website.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">XSS vulnerabilities are caused by a web application not properly escaping data from external sources (such as GET data, POST data, RSS feeds or URLs).</span>
<span lang="en" dir="ltr" class="mw-content-ltr">The range of attacks that can be made via XSS are very diverse, ranging from harmless pranks to the hijacking of an authenticated user's account.</span> 

<div lang="en" dir="ltr" class="mw-content-ltr">
'''Primary defenses''': To avoid XSS attacks, the basic principles are:
</div>
*  <span lang="en" dir="ltr" class="mw-content-ltr">Validate your input</span>
*  <span lang="en" dir="ltr" class="mw-content-ltr">Escape your output</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
You can skip validation, but you can never skip escaping.
</div>
<span lang="en" dir="ltr" class="mw-content-ltr">Escape everything.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Escape as close to the output as possible, so that the reviewer can easily verify that it was done.</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
Note that output encoding (escaping) is context sensitive.
</div>
<span lang="en" dir="ltr" class="mw-content-ltr">So be aware of the intended output context and encode appropriately (e.g. HTML entity, URL, JavaScript, etc.)</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
The [https://wiki.owasp.org/index.php/OWASP_Cheat_Sheet_Series OWASP Abridged XSS Prevention Cheat Sheet] is a useful and up to date quick reference guide for mitigating XSS issues.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
If you are writing JavaScript, please ensure that you understand [[Special:MyLanguage/DOM-based XSS|DOM-based XSS]], and how to prevent it in your code.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== Cross-site request forgery (CSRF) ===
</div>
<span lang="en" dir="ltr" class="mw-content-ltr">''For detailed information on avoiding CSRF vulnerabilities in MediaWiki, read the {{ll|Cross-site request forgery}} article.''</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Cross-site request forgery (CSRF or XSRF) attacks use authentication credentials cached in a victim's browser (such as a cookie or cached username and password) to authorise malicious HTTP requests.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">The malicious HTTP request can be sent in many ways.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">As long as the requests are processed by a web browser that has cached authentication credentials, a CSRF attack can be attempted.</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
'''Primary defenses''': Our primary defense mechanism against CSRF attacks is to add [[Special:MyLanguage/Manual:Edit token|edit tokens]] to HTML forms.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== SQL injection ===
</div>
<span lang="en" dir="ltr" class="mw-content-ltr">''For detailed information on avoiding SQL injection, read the [[SQL injection]] article.''</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
SQL injection relies on poorly validated input being used in a database query, possibly allowing an attacker to run arbitrary SQL queries on your server.
</div>
<span lang="en" dir="ltr" class="mw-content-ltr">The attacker may then be able to fetch private data, destroy data or cause other unintended responses.</span>
<span lang="en" dir="ltr" class="mw-content-ltr">In the worst case, the injected code could allow the attacker to gain full control of the system by exploiting multiple vulnerabilities in the database server, system utilities and operating system.</span>

<span lang="en" dir="ltr" class="mw-content-ltr">'''Primary defenses''': The primary defense against SQL injection is to use [[Special:MyLanguage/Manual:Database access|MediaWiki's built-in database functions]].</span>
<span lang="en" dir="ltr" class="mw-content-ltr">Avoid using direct SQL queries at all costs.</span>

=== <code>serialize()</code> / <code>unserialize()</code> ===
<span lang="en" dir="ltr" class="mw-content-ltr"><code>unserialize()</code> can lead to arbitrary code execution.</span> 
<span lang="en" dir="ltr" class="mw-content-ltr">To prevent this MediaWiki developers should always use json instead of php serialisation in new code.</span>

<div lang="en" dir="ltr" class="mw-content-ltr">
'''Primary defenses''': Use {{phpi|FormatJson::encode()}} and {{phpi|FormatJson::decode()}} instead of PHP's native serialisation.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=== Historical ===
</div>
* <span lang="en" dir="ltr" class="mw-content-ltr">[[register_globals]], has not been an issue since {{ll|MediaWiki 1.24|MediaWiki 1.24}}+.</span>

<span id="See_also"></span>
==Tsham-ua̍t==
* {{ll|Security checklist for developers}} – <span lang="en" dir="ltr" class="mw-content-ltr">a checklist of common development tasks, and the security measures necessary for those tasks</span>
** {{ll|Continuous integration/Phan/Phan-taint-check-plugin|phan-taint-check-plugin}} – <span lang="en" dir="ltr" class="mw-content-ltr">a static analysis tool specifically for MediaWiki that checks your extension for common security flaws.</span> <span lang="en" dir="ltr" class="mw-content-ltr">Run as part of {{ll|Continuous integration/Phan|Phan}}.</span>
** [[PhpStorm project security]] – <span lang="en" dir="ltr" class="mw-content-ltr">for developers who use the [[w:PhpStorm|PhpStorm]] development environment</span>
* {{ll|Security}} – <span lang="en" dir="ltr" class="mw-content-ltr">How to report security issues in Wikimedia software</span>
* <span lang="en" dir="ltr" class="mw-content-ltr">Common vulnerabilities</span>
** {{ll|Cross-site scripting}}
** {{ll|Cross-site request forgery}}
** {{ll|SQL injection}}
** [https://www.owasp.org/ Open Web Application Security Project] (OWASP) – <span lang="en" dir="ltr" class="mw-content-ltr">general overview of vulnerabilities</span>
* {{ll|Manual:Security}} – <span lang="en" dir="ltr" class="mw-content-ltr">information for MediaWiki system administrators how to harden your MediaWiki installation</span>

<span id="Subpages"></span>
== Tsú-ia̍h-bīn ==
* [[Security for developers/Architecture]]
* [[Security for developers/Tutorial]]

<references/>
{{Conventions navigation}}

[[Category:Security{{#translation:}}]]