XF 2.3 Securing an Addon

[Liam C.]

Hi there, I am currently creating an addon and I'm looking to try and ensure it's as secure as possible and would like to know either thoughts or suggestions on how to improve it.

I'm currently defining each route's controller with hasPermission at the start before anything else, and returning no permission. Is this a one size fits all solution? Is there any concern?




Second, we're handling form creation. I'm aware to use <xf:form> as it has more security with it but is there anything else I should be doing?

Third, we're soon going to be handling a very sensitive API route for a particular route accessible only to a few. I plan to assign the credentials of this API route in the config and making a class to fetch this data. Is there any concerning implications in how users could potentially abuse this?

 

[Jeremy P]

If you use the built-in tools and existing source as a reference, you should be reasonably secure as a rule of thumb (but of course not a guarantee). Permissions are designed to gate actions by users and groups, so if that's what you want to do then they will help you do that. You can remove some boilerplate (or the potential to forget to guard an action) by overriding preDispatchController:

protected function preDispatchController($action, ParameterBag $params)
{
    if (!\XF::visitor()->hasPermission('groupId', 'permissionId'))
    {
        throw $this->exception($this->noPermission());
    }
}

Second, we're handling form creation. I'm aware to use <xf:form> as it has more security with it but is there anything else I should be doing?

The most important things are probably to sanitize input (using $this->filter(...) in the controller), and to use entities (or at least the DBAL) to perform all database operations. More complex queries should use prepared statements, and failing that manual quoting, for any variable values.

Third, we're soon going to be handling a very sensitive API route for a particular route accessible only to a few. I plan to assign the credentials of this API route in the config and making a class to fetch this data. Is there any concerning implications in how users could potentially abuse this?

If you mean you need to consume a third-party API and you need a place to put credentials, then you would typically use options. If they're really sensitive (ie. admins who can change options should never see them), then storing them in config.php is fine. You can fetch any value from the config out of the box:

$someKey = \XF::config('someKey');

 

[Liam C.]

Perfect! Thank you very much. I'll make sure to consider this whilst developing this addon. Appreciate it!