Joe Merante's Blog

(This was written and first published elsewhere in June 2020) The example below comes from a May 2020 workshop on using CodeQL. To set up CodeQL, you import code into a database to run queries against using the CodeQL language. The results of queries can be viewed inside Visual Studio Code. More resources here . The snippet below checks for potentially unsafe input to $ in jQuery plugins. In the older version of Bootstrap examined in the workshop, an xss vulnerability existed because the library didn't check whether actual DOM elements were being passed to $ , creating an xss sink. For example, when .text() is called in code like $(options.textSrcSelector).text() , an unsafe string passed to $ could be executed by jQuery. The workshop repo suggests one better way to refactor the code. The from/where/select syntax is a little SQL-y, you import javascript to get the autocomplete goodies in VS Code, use classes and predicates to organize and reuse code. Note that = is equalit...

(This was written and first published elsewhere in June 2020) This concept comes from a book I really enjoyed reading last year, Secure by Design . The authors suggest using a "read-once object" to represent sensitive values to avoid unintentional use or data leakage.

Hadn't blogged in a while, this article using the feudal analogy for our relationships with Internet service providers seemed ripe for some quick, caffeinated midday comments. The article's main point is that we are merely vassals to our feudal big tech lords, hoping for the occasional mercy and protection engendered by trust alone, voluntarily benefiting from the convenience and redundancy of ubiquitous, mostly reliable service without the headache of managing our own security configuration. And most of us tend be ok with that or maybe even consider it progress. Agreed, so far. My primary gripe is the failure to analyze or contrast the companies' respective terms of service or actions with respect to very different products and relationships, which makes a scarier sum than the individual parts might reveal. It also misses the opportunity to point out areas most in n eed of change , not to mention many counter-examples of which the author must be aware. For example, he s...

Like many, I use my real name in my Gmail email address.  I swear by the service and have had an account since they became publicly available.  Earlier today, someone re-sent me an email they mistakenly sent to firstname.lastname@gmail.com, whereas mine is the last.first@gmail.com.  So, I tried to register the former as a catchall but it's not available.  I wondered whether another Joe Merante had claimed it.  There are more than one of us out there, although we don't have a town named after us and no yearly gathering (yet?), unlike the Phil Campbells of the world.  (Sadly, while searching for links to Phil Campbell, AL and the Phil Campbell Convention, I noticed the town has recently been devastated by a tornado.  You can help here .)  I couldn't find another claim to a similar email address but remembered the feature in Gmail that will deliver a message even if there is a (misplaced) period anywhere in a recipient's address.  For example,...