Skip to content

Latest commit

 

History

History
133 lines (102 loc) · 10.9 KB

mitigations.md

File metadata and controls

133 lines (102 loc) · 10.9 KB

Mitigation Strategies Analysis for eggjs/egg

Mitigation Strategy: Strict Middleware Ordering and Validation (Egg.js Specific)

  • Description:

    1. app.middleware Array: Utilize Egg.js's app.middleware array within config/config.default.js (and environment-specific configuration files) to explicitly define the order of all middleware. This is a core Egg.js mechanism for controlling request processing flow.
    2. Egg.js Plugin Middleware: Understand how Egg.js plugins register their middleware and ensure their placement aligns with your security requirements. Some plugins might automatically add middleware; be aware of this.
    3. Prioritize Security Middleware: Place Egg.js's built-in security middleware (and any security-related plugin middleware) early in the chain, before middleware that processes user input (like egg-bodyParser) or interacts with databases. This is crucial for Egg.js's security model.
    4. config.middleware: Use the config.middleware array in your configuration to enable/disable specific middleware globally or for specific environments. This is an Egg.js-specific configuration option.

  • Threats Mitigated:

    • Bypassing Security Checks (Critical): Incorrect order can bypass Egg.js's built-in security checks or those provided by security-focused plugins.
    • CSRF Attacks (High): If Egg.js's CSRF protection middleware (or a plugin's) is misplaced, it might be ineffective.
    • XSS Attacks (High): If input sanitization middleware (provided by Egg.js or a plugin) is in the wrong order, XSS vulnerabilities might be exploitable.

  • Impact:

    • Bypassing Security Checks: Risk reduced significantly (from Critical to Low/Negligible).
    • CSRF Attacks: Risk reduced significantly (from High to Low/Negligible).
    • XSS Attacks: Risk reduced significantly (from High to Low/Negligible, in conjunction with other XSS mitigations).

  • Currently Implemented:

    • config/config.default.js: app.middleware array exists but isn't fully optimized for security.

  • Missing Implementation:

    • Explicit ordering of all middleware, including those from plugins, with a focus on security.
    • Environment-specific middleware configurations (e.g., stricter order in config.prod.js).

Mitigation Strategy: Secure config.security Configuration (Egg.js Specific)

  • Description:

    1. config.security Object: Leverage Egg.js's config.security object in your configuration files (config/config.default.js, config.prod.js, etc.) to control built-in security features. This is the primary mechanism for configuring Egg.js's security protections.
    2. CSRF Protection: Enable and correctly configure Egg.js's CSRF protection within config.security. Understand the options (e.g., csrf.enable, csrf.ignoreJSON, csrf.useSession, csrf.getToken, csrf.cookieName, csrf.headerName). Choose the appropriate settings for your application's needs.
    3. XSS Protection: Utilize Egg.js's built-in XSS protection features within config.security. Understand options like xframe, hsts, noopen, nosniff, xssProtection.
    4. ctx.safeStringify: Use ctx.safeStringify judiciously and in conjunction with input validation when serializing data to JSON. This is an Egg.js-specific helper function. Do not rely on it as the sole XSS prevention mechanism.
    5. ctx.helper.escape: Use ctx.helper.escape for HTML escaping when rendering user-provided data in templates. This is an Egg.js-provided helper. Again, this should be in addition to input validation.
    6. Security Headers: Configure appropriate security headers within config.security (e.g., hsts, xframe, csp). Egg.js provides convenient options for setting these headers.
    7. Environment-Specific Settings: Use environment-specific configuration files (e.g., config.prod.js) to enable stricter security settings in production. This is a core Egg.js best practice.

  • Threats Mitigated:

    • CSRF Attacks (High): Directly addresses CSRF vulnerabilities through Egg.js's built-in protection.
    • XSS Attacks (High): Mitigates XSS through built-in filtering and helper functions, and security headers.
    • Clickjacking (Medium): Addresses clickjacking via the xframe option in config.security.
    • MITM Attacks (High): Mitigates MITM attacks (when HTTPS is used) via the hsts option.

  • Impact:

    • CSRF Attacks: Risk reduced significantly (from High to Low/Negligible).
    • XSS Attacks: Risk reduced significantly (from High to Low/Negligible, in conjunction with other XSS mitigations).
    • Clickjacking: Risk reduced significantly (from Medium to Low/Negligible).
    • MITM Attacks: Risk reduced significantly (from High to Low/Negligible, with proper HTTPS setup).

  • Currently Implemented:

    • Basic config.security settings are present, but not fully optimized or reviewed.

  • Missing Implementation:

    • Thorough review and optimization of all config.security options.
    • Environment-specific configurations (especially for production).
    • Proper configuration of CSRF protection (understanding the different options).
    • Consistent use of ctx.safeStringify and ctx.helper.escape.

Mitigation Strategy: Egg.js Plugin Security and Management

  • Description:

    1. Official Plugins: Prioritize using plugins from the official Egg.js organization (eggjs on npm) or well-known, reputable community contributors. This leverages the Egg.js ecosystem's quality control.
    2. Plugin Configuration: Carefully review and configure all settings for each Egg.js plugin, especially those related to security. Plugins often have their own configuration options within your Egg.js configuration files.
    3. egg-security Plugin: Understand the features and configuration options of the egg-security plugin, as it provides many of the core security features. This is a fundamental part of securing an Egg.js application.
    4. Update Plugins via npm: Keep all Egg.js plugins updated to their latest versions using npm update. This ensures you receive security patches provided by the plugin maintainers. This is how Egg.js manages plugin updates.

  • Threats Mitigated:

    • Exploitation of Plugin Vulnerabilities (Critical/High): Vulnerable Egg.js plugins can be exploited.
    • Supply Chain Attacks (High): Compromised plugins can introduce malicious code.

  • Impact:

    • Exploitation of Plugin Vulnerabilities: Risk reduced significantly (from Critical/High to Low/Medium).
    • Supply Chain Attacks: Risk reduced (from High to Medium).

  • Currently Implemented:

    • Some plugins are used, but their configurations haven't been thoroughly reviewed.

  • Missing Implementation:

    • Formal process for selecting and vetting Egg.js plugins.
    • Regular review of plugin configurations.

Mitigation Strategy: Secure File Uploads with egg-multipart (Egg.js Specific)

  • Description:

    1. egg-multipart Configuration: If using egg-multipart (the standard Egg.js plugin for file uploads), carefully configure its options in your Egg.js configuration files. This is the primary way to control file upload security in Egg.js.
    2. fileSize Limit: Set a strict fileSize limit within the egg-multipart configuration to prevent excessively large file uploads.
    3. whitelist (File Extensions): Use the whitelist option in egg-multipart to define a list of allowed file extensions. However, do not rely solely on this; also validate MIME types and file signatures (this part is not Egg.js specific).
    4. mode: Understand the different modes of egg-multipart (file and stream) and choose the appropriate one for your needs.
    5. tmpdir: Configure a secure temporary directory (tmpdir) for egg-multipart to store files during upload. Ensure this directory has appropriate permissions.

  • Threats Mitigated:

    • Arbitrary File Upload (Critical): Misconfigured egg-multipart can allow attackers to upload malicious files.
    • Denial of Service (DoS) (Medium): Large file uploads can exhaust server resources.

  • Impact:

    • Arbitrary File Upload: Risk reduced significantly (from Critical to Low/Medium, in conjunction with other file upload security measures).
    • Denial of Service: Risk reduced (from Medium to Low).

  • Currently Implemented:

    • egg-multipart is used with basic configuration.

  • Missing Implementation:

    • Thorough review and optimization of all egg-multipart configuration options.
    • Strict fileSize limits.
    • Proper use of whitelist (in conjunction with other validation).

Mitigation Strategy: Secure use of Egg.js Context (ctx)

  • Description:

    1. ctx.state: Use ctx.state to store user-specific data securely within the request context. Avoid storing sensitive data directly in ctx. This is an Egg.js-specific mechanism for managing request-scoped data.
    2. ctx.cookies: Use ctx.cookies.set() with the httpOnly, secure, and signed options to securely manage cookies. This is Egg.js's built-in cookie handling.
    3. ctx.session: If using sessions (via egg-session), ensure it's configured securely (e.g., using a secure store, setting appropriate cookie options). This relies on Egg.js's session management.
    4. Avoid ctx.unsafeXXX methods: Be extremely cautious when using any methods on the ctx object that are marked as "unsafe" (e.g., avoid if possible). These bypass built-in security protections.

  • Threats Mitigated:

    • Session Hijacking (High): Insecure cookie or session management can lead to session hijacking.
    • Data Leakage (Medium): Improper use of ctx can expose sensitive data.
    • XSS (High): If data from ctx is rendered without proper escaping.

  • Impact:

    • Session Hijacking: Risk reduced significantly (from High to Low/Negligible).
    • Data Leakage: Risk reduced (from Medium to Low).
    • XSS: Risk reduced (in conjunction with other mitigations).

  • Currently Implemented:

    • ctx is used, but not always with a focus on security best practices.

  • Missing Implementation:

    • Consistent use of secure cookie options (httpOnly, secure, signed).
    • Review of session management configuration (if egg-session is used).
    • Avoidance of ctx.unsafeXXX methods.