TurboGears ¶
Components¶
Access Control/Authorization¶
See access control.
What mechanisms are there to restrict URL access?
What permissions model is available?
How hard is it to define who should be able to access what?
Authentication¶
See authentication.
What authentication methods are available?
What hash method is used on user credentials? Is it salted?
Could account creation overwrite an existing account?
Could the change password or recover password functions be used maliciously?
Configuration¶
See configuration.
Are the framework dependencies up to date? Are there security vulnerabilities in the versions used by the framework?
Are there default account passwords?
If there an exception handler, will it run in production? Are there notes and reminders to turn it off in configuration?
Cross-Site Request Forgery (CSRF)¶
See cross-site request forgery.
Are there GET requests that change state? This helps enable CSRF.
What mechanisms are there to add CSRF tokens to forms? How easy is it to use?
Cross-Site Scripting (XSS)¶
See cross-site scripting.
What specific escaping does the template engine do to prevent XSS? What does the developer need to do to use it? What is automatic and what is manual?
Are there vulnerabilities in the template engine?
Cryptography¶
See cryptography.
What in the application is encrypted? Are there items that should be encrypted that are not?
What algorithm is it using?
Where is the key stored?
Who can access the encrypted data?
Injection¶
See injection.
What interpreters is the framework capable of using?
How does it access a database? What about LDAP queries or OS commands?
What escaping is done on data headed to an interpreter?
Can a developer write raw SQL? If so, proper escaping is almost certainly not done. Documentation should have a large warning indicating they may be vulnerable to SQL injection.
Object Reference¶
See object reference.
Is there a mechanism to proxy direct object references through an indirect reference?
Redirects and Forwards¶
Can a URL be crafted to redirect to an arbitrary site?
Session Management¶
See session management.
How are session IDs generated?
Are session IDs ever exposed in the URL? Leaking session IDs through logs, referrer headers, etc can lead to compromised accounts.
Are session IDs accepted through GET or POST data? This would aid in session fixation attacks.
Do session IDs timeout?
Can users log out?
Are session IDs changed after login?
Transport Layer Security¶
Can the framework be used with SSL? What is required and how difficult is it to set up?
When used in SSL mode, do session cookies have the 'secure' flag set?
Validation¶
See validation.
Is there a mechanism available that allows developers validate input data against a schema? Regex validation as well as custom attributes like numeric comparison. Having developers directly use the re module does not count.
-
Wiki content is available under a Creative Commons 3.0 License.
