OWASP Top Vulnerabilities. Here is Oxygis' position on the main web application security issues, as listed by the Open Web Application Security Project (OWASP): • Injection flaws: Injection flaws, including SQL injection, are common in web applications. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data causes the interpreter to execute unwanted commands or modify data. Oxygis uses an ORM that abstracts the construction of queries and prevents SQL injections. Normally, developers do not manually build SQL queries, which are generated by the ORM, and the parameters are always correctly escaped. • Cross Site Scripting (XSS): XSS flaws occur when an application takes user-supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute scripts in the victim's browser, which can hijack user sessions, deface websites, possibly introduce worms, etc. Oxygis escapes all data which prevents XSS. • Cross Site Request Forgery (CSRF): A CSRF attack forces a logged-in victim's browser to send a fake HTTP request, including the victim's session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim's browser to generate requests that the vulnerable application thinks are legitimate requests from the victim. Oxygis includes a built-in CSRF protection mechanism. It prevents any HTTP controller from receiving a request without the corresponding security token. This is the recommended technique for CSRF prevention. • Malicious file execution: Remote File Inclusion (RFI) vulnerable code allows attackers to include hostile code and data, resulting in devastating attacks, such as total server compromise. Oxygis does not expose functions for remote file inclusion. • Insecure direct object reference: A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter. Attackers can manipulate these references to gain unauthorised access to other objects. Access control to Oxygis is not implemented at the user interface, so there is no risk of exposing references to internal objects in URLs. Attackers cannot bypass the access control layer by manipulating these references, as each request must always pass through the data access validation layer.
