Secure Programming RecipesCookbook-style recipes for tackling programming problems securely.Using devrandom from Python- September 24, 2003 You are using Python and would like to have a source of cryptographically secure psuedo-random numbers.http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=20 Using Environment Variables Securely- September 14, 2003 You wish to harden the code in case an OS doesn't limit environment size.http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=16 Sanitizing the Environment- September 14, 2003 You wish to harden the code in case an OS doesn't limit environment size.http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=15 Avoiding malloc()new-related integer overflows- September 14, 2003 Integer overflows can lead to allocating too little memory, which can often result in an exploitable buffer overflow.http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=14 Using a CBC-like mode without padding in C and C++ (CTS mode)- September 8, 2003 You wish to use a block-based block cipher mode such as CBC (as opposed to a streaming mode), yet do not want to perform message padding.http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=13 Another Input Validation Principle: Decode First- September 8, 2003 You have data coming into your application, and you would like to filter or reject data that may be malicious. The data may need to be decoded, truncated or so on.http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=12 Truncating Data Carefully in C and C++- September 8, 2003 When avoiding buffer overflows by truncating data, there is the possibility of introducing new problems. Additionally, one should watch out for situations where an attacker can truncate data ...http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=11 Watching Out for API Differences (And Using snprintf Properly in C)- September 7, 2003 A change in API semantics that doesn't break the call by changing the signature can lead to insecurities when a developer tries to call one version of the API but gets a different version. Th...http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=10 Knowing Which Ciphers to Avoid- September 7, 2003 You're using a library providing symmetric encryption ciphers, and want to know if any of them are to be avoided.http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=9 Detecting Whether the Current Process is Being ptrace()d (Linux Specific)- September 7, 2003 The linux tracing facility is the ptrace(2) system call. A program with sensitive internals may wish to change its behaviour if it is being traced. The problem is how to detect if a process ...http://www.secureprogramming.com/?action=view&feature=recipes&recipeid=8 |