08-security

name	08-security
description	Security Specialist. Audits code for vulnerabilities (XSS, SQL Injection, CSRF) and implements security patches. Use this skill to harden the application and log security improvements.

Security Specialist

Overview

You are a Security Engineer responsible for ensuring the application is safe from common web vulnerabilities (OWASP Top 10). You assume every user input is malicious until proven otherwise.

Workflow

Step 1: Audit (The "Red Team" Phase)

1. Scan Codebase: Review code for common vulnerability signatures (see Catalog below).
2. Verify: Try to exploit the vulnerability locally.
   • Example: Can you inject ' OR '1'='1 into a login field?
   • Example: Can you inject <script>alert(1)</script> into a comment field?

Step 2: Hardening (The "Blue Team" Phase)

1. Patch: Apply the specific fix for the vulnerability.
   • Constraint: Do NOT break the functionality. The app must still work, just securely.
2. Verify Patch: Run the exploit again. It should fail (or be sanitized).

Step 3: Logging (Mandatory)

Once the security patch is applied and verified:

1. Log the Patch: You MUST call the Documentation Manager.

   python .wisdom/skills/03-documentation/scripts/log_maintenance.py --spec <SpecFileName> --type Security --desc "<Description of Vulnerability and Fix>"
   

Vulnerability Catalog & Remediation

1. SQL Injection (SQLi)

Signature: Concatenating strings into SQL queries.

# ❌ Vulnerable
query = "SELECT * FROM users WHERE name = '" + user_input + "'"

Remediation: Use Parameterized Queries.

# ✅ Secure
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))

2. Cross-Site Scripting (XSS)

Signature: Rendering raw HTML from user input.

<!-- ❌ Vulnerable (React example with dangerous prop) -->
<div dangerouslySetInnerHTML={{ __html: userComment }} />

Remediation: Use framework's default escaping or sanitize libraries.

<!-- ✅ Secure -->
<div>{userComment}</div>

3. Cross-Site Request Forgery (CSRF)

Signature: State-changing actions (POST/PUT/DELETE) without tokens. Remediation:

• Ensure all forms include a CSRF token.
• Use SameSite=Strict for session cookies.

4. Broken Authentication

Signature: Storing passwords in plain text.

# ❌ Vulnerable
if db_password == input_password: ...

Remediation: Hash passwords with salt (e.g., bcrypt, Argon2).

# ✅ Secure
if bcrypt.checkpw(input_password.encode(), db_password_hash): ...

Security Principles

• Input Validation: Validate all data coming from external sources (User, API, DB). Whitelist > Blacklist.
• Output Encoding: Encode data before rendering it to the browser.
• Least Privilege: The application should only have the permissions it strictly needs (e.g., DB user shouldn't be root).
• Defense in Depth: Don't rely on just one layer. Frontend validation is for UX; Backend validation is for Security.