Realized during the port the PHP site had been att...

# kobalt

[cedric]

Realized during the port the PHP site had been attacked many times and had a lot of spam in its database, but none user visible. At least now I’m much more confident in the security.

[jlleitschuh]

@cedric I thought that was a completely static site? What was the DB for?

Also, anything that may impact users of TestNG or similar?

[cedric]

@jlleitschuh DB? There’s no DB for the TestNG site, it’s all static. The web site I rebuilt in Kotlin recently is a different one, https://www.perryrhodan.us

[jlleitschuh]

Ah! Okay.

[cedric]

Kotlin, Exposed, Guice, DropWizard. Pretty simple stack but super effective, and I think pretty robust so far.

[jlleitschuh]

For the DB did you use prepared statements? Or is that what got you in the old one?

[cedric]

That’s Exposed’s job, not mine 🙂

[cedric]

I hope the DSL they offer does issue safe SQL queries

[cedric]

and either way, none of these are exposed in URL’s obviously

[jlleitschuh]

Right, yes. It should be.
Is that what got you on the PHP site?

[cedric]

Actually no, it was pretty safe there, but there’s a mechanism where people can submit summaries anonymously. These go into a pending table until I can review them. That’s what spammers used. Not realizing this content is never exposed until I approve it

[cedric]

I got also a few other attacks, people trying to download unauthorized files from PHP, etc… but these were defeated by my host, as far as I can tell

[jlleitschuh]

Bahahah. Ah! Yea. Gotta integrate something like Google's reCAPTCHA

[jlleitschuh]

Most of the "attacks" are probably just random internet scans and automated tools.

[jlleitschuh]

It's like the wild west out there.

[cedric]

Yes. At least with a Kotlin/DropWizard site, I feel pretty safe

[jlleitschuh]

You really have to be careful about upload when it comes to PHP sites.

If you can upload a PHP file to a server and then get the webserver to run it, you have an instant reverse shell.

Nothing similar I'm aware of with the Java ecosystem, unless you have dynamic classloading from arbitrary paths, but at least that's not something Java will support by default.

Is the HTML all Kotlin generated as well?

[cedric]

Learned that namecheap is not compatible about SSL with heroku though, so lesson learned

[cedric]

HTML is server side mustache.

[cedric]

https://github.com/cbeust/perry-kotlin/tree/master/src/main/resources/com/beust/perry

[jlleitschuh]

Who'd you use for SSL then? Lets Encrypt?

[cedric]

Yes Let’s Encrypt. It kind of works over all but redirects for domains doesn’t 100%

[cedric]

I will switch to another provider, that needs to support A records (which namecheap doesn’t)

[jlleitschuh]

If you let anyone upload custom content, you need to be careful about mustache. I don't know if it does HTML escaping meaning you can have a user submit javascript which will be stored and can be run in another users browser.

Not a huge deal though here because you don't have a "login" where someone could risk loosing something valuable.

[jlleitschuh]

But, just as a general precaution.

[cedric]

Fair point.

[jlleitschuh]

Any updates on getting the TestNG site to automatically redirect all port 80 requests to port 443?

[jlleitschuh]

http://testng.org/doc/migrating.html

[jlleitschuh]

Also, you're still suggesting users resolve testNG insecurely here:
http://testng.org/doc/download.html

[jlleitschuh]

<url>http://jcenter.bintray.com</url>

[cedric]

That I can fix easily

[jlleitschuh]

🎆

[jlleitschuh]

I just sent an email to Jfrog Bintray and Sonatype suggesting they drop support for resolving artifacts over http starting in early 2020.

[cedric]

Try again for the redirect, @jlleitschuh

[jlleitschuh]

@cedric No cigar.

[cedric]

Really? I just clicked on your URL above and landed on https

[jlleitschuh]

Actually, it worked. I had to try it in an incognito tab

[jlleitschuh]

It was just that chrome had it cached.

[cedric]

Cool.

[cedric]

Also did a global replace of http->https on most of the doc, for my domains anyway

[jlleitschuh]

while you're already in there, do you want to add the strict transport security header?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

[cedric]

Sounds more complicated than what I’m wishing to do right now 🙂

[jlleitschuh]

It will tell browsers to "remember" to use htttps so your sever won't have to tell them to redirect.

[jlleitschuh]

Fair enough

[jlleitschuh]

Alright, I'm off.

Please do try to fix the documentation that tells users to use:

<url>http://jcenter.bintray.com</url>

I'm already seeing it in far too many open source projects.