How 5 Security Considerations When Coding

1. Input Test Always check user input to make sure it is what you expect. Make sure it does not contain any characters or details that can be handled by your system or any programs called by your system. This usually includes checking for characters such as quoted, as well as checking for unusual characters that are not. Alphanumeric characters where the text character unit is expected. Usually, these are signs of an attack of some kind being attempted. 2. Testing the Scope Always check scope when copying data, providing memory or performing any task that may overflow. Some programming languages ​​provide access to a test object range ()such as std :: vector :: at () in C ++, but most programmers insist on using an unchecked array index [] notation. In addition, the use of strcpy () functions should be avoided over strncpy (), which allows you to specify the maximum number of characters you can copy. Similar versions of functions like snprintf () as opposed to sprintf () and fgets () instead of gets () provide equal of buffer. The use of such functions throughout your code should prevent overflow of buffer. Even if your character unit goes out of the system, and you think you can escape with strcpy () because you know the unit length of the character, that doesn't mean you, or anyone else, will not change things in the future and allow the character unit to be specified in the configuration file, command line, or input in a specific user interface. scope testing should all prevent obesity and security risks from your software. 3. Principles of Minimum Rights This is especially important if your system is operating as the root of any part of its operating time. Where possible, the system should relinquish any rights it does not need, and exercise the highest rights only for those functions that it requires. An example of this is the Postfix post server, which has a modular design that allows sections requiring root privileges to be run smoothly in non-performing sections. This type of entitlement reduces the number of invasive methods leading to root rights, and increases the security of the entire system because those few remaining methods can be critically analyzed in terms of security issues. 4. Do not rush Racing mode is a situation where the system performs a task in a few steps, and the attacker has the opportunity to catch it between the steps and change the state of the system. An example would be a program that checks file permissions, and then opens the file. Between permission check the stat () call and file fopen () call attacker can change the open file by renaming another file in the name of the original files. To prevent this, fopen () the file first, then use fstat (), which replaces the file identifier. Since the file identifier always points to a file opened with fopen (), even if the file name is changed later, the fstat () call will be verified checking permissions for the same file. There are many other racist situations, and there are often ways to prevent them by carefully choosing the order in which certain tasks are performed. 5.Register Error Holders Many languages ​​support the concept of work that can be called when an error is detected, or a flexible concept of diversity. Use these to catch unexpected situations and return to a safe place in the code, instead of blindly advancing in the hope that the user input will not interrupt the system, or worse!