AgentSkillsCN

secure-coding

OWASP 安全编码实践、特定语言的安全考量、输入验证与输出编码、认证与授权模式、密码学最佳实践、安全 API 设计，以及常见的安全反模式。

SKILL.md
--- frontmatter
name: secure-coding
description: OWASP secure coding practices, language-specific security considerations, input validation and output encoding, authentication and authorization patterns, cryptography best practices, secure API design, and common security anti-patterns

Secure Coding

OWASP Secure Coding Practices

Input Validation

  • •Validate All Input: Validate all input from untrusted sources (user input, APIs, files)
  • •Whitelist Approach: Use whitelisting (allow-list) instead of blacklisting
  • •Validate Type, Length, Format: Validate data type, length, and format
  • •Sanitize Output: Encode output to prevent injection attacks
  • •Canonicalize Input: Canonicalize input before validation to prevent bypasses

Output Encoding

  • •Context-Specific Encoding: Use encoding appropriate for the context (HTML, JavaScript, URL, CSS)
  • •Encode User-Generated Content: Encode all user-generated content before output
  • •Use Framework Encoding: Use framework-provided encoding functions
  • •Avoid Manual Encoding: Avoid manual encoding as it's error-prone

Authentication

  • •Strong Passwords: Enforce strong password policies (length, complexity, rotation)
  • •Secure Password Storage: Use strong, slow hashing algorithms (bcrypt, Argon2, scrypt)
  • •Multi-Factor Authentication: Implement MFA for sensitive operations
  • •Secure Session Management: Use secure, HTTP-only, SameSite cookies
  • •Session Expiration: Implement appropriate session timeout
  • •Secure Password Reset: Implement secure password reset mechanisms

Authorization

  • •Principle of Least Privilege: Grant minimum necessary permissions
  • •Role-Based Access Control: Implement RBAC for authorization
  • •Attribute-Based Access Control: Consider ABAC for complex authorization
  • •Deny by Default: Deny access by default, explicitly allow
  • •Check Authorization on Every Request: Verify authorization on every request
  • •Avoid IDOR: Prevent Insecure Direct Object References

Cryptography

  • •Use Standard Algorithms: Use well-vetted, standard cryptographic algorithms
  • •Avoid Rolling Your Own Crypto: Never implement custom cryptography
  • •Use Secure Key Management: Properly generate, store, and rotate keys
  • •Use Authenticated Encryption: Use authenticated encryption (AEAD) when possible
  • •Avoid Deprecated Algorithms: Avoid MD5, SHA1, RC4, DES, etc.
  • •Use TLS: Use TLS for all network communications

Error Handling

  • •Generic Error Messages: Use generic error messages for users
  • •Detailed Logging: Log detailed error information server-side
  • •Don't Leak Information: Avoid leaking sensitive information in errors
  • •Handle Exceptions: Properly handle exceptions to prevent information disclosure
  • •Custom Error Pages: Use custom error pages to prevent information leakage

Language-Specific Security Considerations

JavaScript/TypeScript

  • •XSS Prevention: Use frameworks with built-in XSS protection (React, Vue, Angular)
  • •Content Security Policy: Implement CSP to mitigate XSS
  • •Avoid eval(): Avoid using eval() and similar dynamic code execution
  • •Validate JSON: Validate JSON input before parsing
  • •Use Strict Mode: Use strict mode to catch common errors
  • •Sanitize HTML: Use DOMPurify or similar libraries for HTML sanitization

Python

  • •SQL Injection: Use parameterized queries or ORM
  • •Command Injection: Avoid shell=True in subprocess calls
  • •Pickle Security: Avoid unpickling untrusted data
  • •Template Injection: Use secure template engines (Jinja2 auto-escaping)
  • •YAML Loading: Use yaml.safe_load() instead of yaml.load()
  • •Input Validation: Validate input using libraries like pydantic

Java

  • •SQL Injection: Use PreparedStatement or JPA
  • •XSS Prevention: Use OWASP ESAPI or framework-provided encoding
  • •Deserialization: Avoid deserializing untrusted data
  • •XML Security: Disable XML external entities (XXE)
  • •Path Traversal: Validate file paths to prevent directory traversal
  • •Secure Random: Use SecureRandom for cryptographic random numbers

Go

  • •SQL Injection: Use prepared statements with sql package
  • •Path Traversal: Use filepath.Join() and validate paths
  • •Command Injection: Avoid shell commands, use exec package
  • •Template Injection: Use html/template with auto-escaping
  • •Error Handling: Always handle errors explicitly
  • •Input Validation: Validate input before use

C/C++

  • •Buffer Overflows: Use safe string functions (strncpy_s, snprintf)
  • •Memory Safety: Use memory-safe alternatives when possible
  • •Integer Overflow: Check for integer overflow before arithmetic
  • •Format String Vulnerabilities: Avoid user-controlled format strings
  • •Use Safe Libraries: Use safe string and memory libraries
  • •Static Analysis: Use static analysis tools to catch issues

PHP

  • •SQL Injection: Use PDO with prepared statements
  • •XSS Prevention: Use htmlspecialchars() or framework escaping
  • •File Upload: Validate and sanitize uploaded files
  • •Include Files: Avoid user-controlled include files
  • •Type Juggling: Be aware of PHP's type juggling
  • •Configuration: Use secure configuration settings

Input Validation and Output Encoding

Input Validation Techniques

  • •Type Validation: Validate data type (integer, string, date, etc.)
  • •Length Validation: Validate minimum and maximum length
  • •Format Validation: Validate format (email, phone, URL, etc.)
  • •Range Validation: Validate numeric ranges
  • •Pattern Validation: Use regex patterns for complex validation
  • •Business Rule Validation: Validate against business rules

Output Encoding Contexts

  • •HTML Context: Encode for HTML entities (<, >, &, ", ')
  • •JavaScript Context: Encode for JavaScript strings
  • •URL Context: Encode for URL parameters
  • •CSS Context: Encode for CSS values
  • •Attribute Context: Encode for HTML attributes

Encoding Libraries

  • •JavaScript: DOMPurify, encodeURI(), encodeURIComponent()
  • •Python: html.escape(), urllib.parse.quote()
  • •Java: OWASP ESAPI, Apache Commons Text
  • •Go: html.EscapeString(), url.QueryEscape()
  • •PHP: htmlspecialchars(), urlencode()

Authentication and Authorization Patterns

Authentication Patterns

  • •Multi-Factor Authentication: Require multiple factors for authentication
  • •Password Hashing: Use bcrypt, Argon2, or scrypt for password hashing
  • •Password Policies: Enforce strong password policies
  • •Account Lockout: Implement account lockout after failed attempts
  • •Password Reset: Implement secure password reset flows
  • •Session Management: Use secure session management practices

Authorization Patterns

  • •Role-Based Access Control (RBAC): Assign permissions to roles, roles to users
  • •Attribute-Based Access Control (ABAC): Use attributes for fine-grained access control
  • •Access Control Lists (ACL): Define access rights for resources
  • •Capability-Based Security: Use capabilities for access control
  • •Policy-Based Access Control: Use policies for access decisions
  • •Hybrid Approaches: Combine multiple authorization patterns

Session Management

  • •Secure Cookies: Use secure, HTTP-only, SameSite cookies
  • •Session Expiration: Implement appropriate session timeout
  • •Session Fixation: Generate new session ID after authentication
  • •Session Storage: Store session data securely
  • •Logout: Implement proper logout functionality
  • •Concurrent Sessions: Limit concurrent sessions if needed

Cryptography Best Practices

Encryption

  • •Use Standard Algorithms: Use AES-256, ChaCha20-Poly1305, or similar
  • •Use Authenticated Encryption: Prefer AEAD modes (GCM, CCM, ChaCha20-Poly1305)
  • •Key Management: Use proper key management (HSM, KMS, key rotation)
  • •IV/Nonce: Use unique IV/nonce for each encryption
  • •Key Derivation: Use PBKDF2, Argon2, or scrypt for key derivation
  • •Avoid ECB Mode: Never use ECB mode for encryption

Hashing

  • •Use Strong Hashes: Use SHA-256 or stronger for general hashing
  • •Password Hashing: Use bcrypt, Argon2, or scrypt for passwords
  • •Salt: Use unique salt for each password hash
  • •Slow Hashing: Use computationally expensive hashing for passwords
  • •Avoid MD5/SHA1: Avoid MD5 and SHA1 for security purposes

Key Management

  • •Key Generation: Use cryptographically secure random number generators
  • •Key Storage: Store keys securely (HSM, KMS, encrypted at rest)
  • •Key Rotation: Rotate keys regularly
  • •Key Separation: Use different keys for different purposes
  • •Key Destruction: Securely destroy keys when no longer needed
  • •Key Escrow: Consider key escrow for recovery if needed

TLS/SSL

  • •Use TLS 1.3: Prefer TLS 1.3 when available
  • •Strong Ciphers: Use strong cipher suites
  • •Certificate Validation: Always validate certificates
  • •HSTS: Implement HTTP Strict Transport Security
  • •Perfect Forward Secrecy: Use cipher suites with PFS
  • •Disable Weak Protocols: Disable SSLv2, SSLv3, TLS 1.0, TLS 1.1

Secure API Design

API Security Best Practices

  • •Authentication: Implement strong authentication (OAuth 2.0, JWT, API keys)
  • •Authorization: Implement proper authorization for all endpoints
  • •Rate Limiting: Implement rate limiting to prevent abuse
  • •Input Validation: Validate all input to API endpoints
  • •Output Encoding: Encode output appropriately
  • •Error Handling: Use generic error messages, log details server-side
  • •HTTPS: Always use HTTPS for API communication
  • •API Versioning: Use versioning to manage breaking changes
  • •Documentation: Document security considerations
  • •Monitoring: Monitor API usage for anomalies

REST API Security

  • •Stateless: Keep APIs stateless
  • •Resource-Based Design: Design around resources
  • •HTTP Methods: Use HTTP methods correctly (GET, POST, PUT, DELETE)
  • •Status Codes: Use appropriate HTTP status codes
  • •Pagination: Implement pagination for large datasets
  • •Filtering/Sorting: Allow filtering and sorting
  • •CORS: Configure CORS appropriately
  • •CSRF: Implement CSRF protection for state-changing operations

GraphQL Security

  • •Query Depth Limiting: Limit query depth to prevent DoS
  • •Query Complexity Limiting: Limit query complexity
  • •Rate Limiting: Implement rate limiting
  • •Authentication: Implement authentication at the resolver level
  • •Authorization: Implement authorization at the resolver level
  • •Introspection: Disable introspection in production
  • •Field-Level Authorization: Implement field-level authorization

Common Security Anti-Patterns

Code Anti-Patterns

  • •Hardcoded Secrets: Never hardcode passwords, API keys, or tokens
  • •SQL String Concatenation: Never concatenate SQL strings
  • •Shell Command Concatenation: Never concatenate shell commands
  • •eval() Usage: Avoid using eval() or similar functions
  • •Trust Client-Side Validation: Never trust client-side validation
  • •Ignore Error Messages: Don't ignore error messages
  • •Roll Your Own Crypto: Never implement custom cryptography

Configuration Anti-Patterns

  • •Default Credentials: Never use default credentials in production
  • •Debug Mode: Never enable debug mode in production
  • •Verbose Error Messages: Don't expose detailed errors to users
  • •Insecure Defaults: Don't use insecure default configurations
  • •Unnecessary Services: Don't run unnecessary services
  • •Open Ports: Don't expose unnecessary ports

Architecture Anti-Patterns

  • •Security Through Obscurity: Never rely on obscurity for security
  • •Single Layer of Defense: Never rely on a single security control
  • •Trust Boundaries: Don't trust components across trust boundaries
  • •Assume Safe Input: Never assume input is safe
  • •Ignore Logging: Don't ignore security logging
  • •Skip Testing: Never skip security testing

Development Anti-Patterns

  • •Skip Code Review: Never skip security code reviews
  • •Ignore Dependencies: Don't ignore dependency vulnerabilities
  • •Rush Deployment: Don't rush deployments without testing
  • •Disable Security Controls: Never disable security controls for convenience
  • •Ignore Alerts: Don't ignore security alerts
  • •Assume It's Secure: Never assume something is secure without verification