End-to-end Injection Safety at Scale Mike Samuel, Google Security - - PowerPoint PPT Presentation

▶
end to end injection safety at scale
SMART_READER_LITE
LIVE PREVIEW

End-to-end Injection Safety at Scale Mike Samuel, Google Security - - PowerPoint PPT Presentation

Jan 23, 2023 109 likes •409 views

End-to-end Injection Safety at Scale Mike Samuel, Google Security Engineering March 2019 2019 | About me Security engineer @ Google Hacks libraries, tools, languages TC39 member ( JavaScript language committee ) Editor of "A Roadmap

slide-1
SLIDE 1

2019 |

March 2019

End-to-end Injection Safety at Scale

Mike Samuel, Google Security Engineering

slide-2
SLIDE 2

2019 |

About me

Security engineer @ Google Hacks libraries, tools, languages TC39 member ( JavaScript language committee ) Editor of "A Roadmap for Node.js Security" Mission: make the easiest way to express an idea in code, a secure way @mvsamuel

slide-3
SLIDE 3

2019 |

Trusted Types

  • W3 Proposal
  • Builds on 6+ years of experience

within Google

  • Protects Gmail, many other complex apps
  • Evidence of efficacy
slide-4
SLIDE 4

2019 |

Trusted Types

  • 1. Problem statement
  • 2. Small change ⇨ big organizational effect
  • 3. Adoption in practice
  • 4. Early adopters welcome
slide-5
SLIDE 5

2019 |

"Today, a novice programmer cannot write a complex but secure application."

Breaking XSS mitigations via Script Gadgets - blackhat 2017

slide-6
SLIDE 6

2019 |

slide-7
SLIDE 7

2019 |

slide-8
SLIDE 8

2019 |

slide-9
SLIDE 9

2019 |

"Today, a novice programmer cannot write a complex but secure application."

Breaking XSS mitigations via Script Gadgets - blackhat 2017

slide-10
SLIDE 10

2019 |

Reduce developers' security burden. Move it to security professionals.

slide-11
SLIDE 11

2019 |

Client-side JavaScript <div id=foo></div> <script> var foo = document.querySelector('#foo'); foo.innerHTML = 'raw-string'; </script>

slide-12
SLIDE 12

2019 |

Client-side JavaScript <meta http-equiv=... content="trusted-types p" /> <div id=foo></div> <script> var foo = document.querySelector('#foo'); foo.innerHTML = 'raw-string'; </script>

slide-13
SLIDE 13

2019 |

Trusted Types make Trust decisions explicit <meta http-equiv=... content="trusted-types p" /> <div id=foo></div> <script> var foo = document.querySelector('#foo'); var policy = TrustedTypes.createPolicy('p', {}); var trusted = policy.createHTML('raw-string'); foo.innerHTML = trusted; </script>

slide-14
SLIDE 14

2019 |

Trusted Types make Trust decisions explicit <meta http-equiv=... content="trusted-types p" /> <div id=foo></div> <script> var foo = document.querySelector('#foo'); var policy = TrustedTypes.createPolicy('p', {}); var trusted = policy.createHTML('raw-string'); foo.innerHTML = trusted; </script>

slide-15
SLIDE 15

2019 |

Trusted Types make Trust decisions explicit <meta http-equiv=... content="trusted-types p" /> <div id=foo></div> <script> var foo = document.querySelector('#foo'); var policy = TrustedTypes.createPolicy('p', {}); var trusted = policy.createHTML('raw-string'); foo.innerHTML = trusted; </script> Our code is safe because trust decisions are explicit & reviewed by security team and we check trustedness before doing the undoable.

slide-16
SLIDE 16

2019 |

Step 1. Flip the switch

  • Trust decisions

Implicit

  • No separation btw.

sensitive and other code

  • Un-undoable acts

not checked

  • Bugs non-obvious
  • Fails unsafe
  • Trust decisions

Implicit

  • No separation btw.

sensitive and other code

  • Un-undoable acts

checked

  • Bugs obvious
  • Fails safe

⇨

slide-17
SLIDE 17

2019 |

Step 2. Consolidate tricky code

  • Trust decisions

Implicit

  • No separation btw.

sensitive and other code

  • Un-undoable acts

checked

  • Bugs obvious
  • Fails safe
  • Trust decisions

explicit

  • Separation btw.

sensitive and other code

  • Un-undoable acts

checked

  • Bugs obvious, fewer
  • Fails safe
  • Sensitive code not

scrutinized

⇨

slide-18
SLIDE 18

2019 |

Step 3. Automatically loop in reviewers

  • Trust decisions

explicit

  • Separation btw.

sensitive and other code

  • Un-undoable acts

checked

  • Bugs obvious, fewer
  • Fails safe
  • Sensitive code not

scrutinized

  • Trust decisions

explicit

  • Separation btw.

sensitive and other code

  • Un-undoable acts

checked

  • Bugs obvious, fewer
  • Fails safe
  • Sensitive code

scrutinized

⇨

slide-19
SLIDE 19

2019 |

Lightweight process help.github.com/en/articles/about-code-owners "Code owners are automatically requested for review when someone opens a pull request that modifies code that they own." CODEOWNERS # Files under sensitive/ need extra sign-off sensitive/ @securityperson

slide-20
SLIDE 20

2019 |

Trusted Types make Trust decisions explicit <meta http-equiv=... content="trusted-types p" /> <div id=foo></div> <script> var foo = document.querySelector('#foo'); var policy = TrustedTypes.createPolicy('p', {}); var trusted = policy.createHTML('raw-string'); foo.innerHTML = trusted; </script> Our code is safe because trust decisions are explicit & reviewed by security team and we check trustedness before doing the undoable.

slide-21
SLIDE 21

2019 |

RealWorld React App github.com/gothinkster/realworld

slide-22
SLIDE 22

2019 |

RealWorld React App public/index.html

slide-23
SLIDE 23

2019 |

RealWorld React App src/components/Article/index.js

slide-24
SLIDE 24

2019 |

RealWorld React App src/components/Article/index.js

slide-25
SLIDE 25

2019 |

RealWorld React App src/index.js

slide-26
SLIDE 26

2019 |

RealWorld React App src/trustedtypes.js

slide-27
SLIDE 27

2019 |

Tools Integration Most trust decisions in common infrastructure that is safe-by-construction:

  • Template Systems (strict, contextually autoescaped)
  • Sanitizers
  • Programmatic Builder APIs
  • Protobufs bridge server- and client-side trusted values.
slide-28
SLIDE 28

2019 |

Trusted Types Gets security eyes on decisions to trust Long experience migrating projects Reduces XSS payments to vulnerability hunters Proposed as web standard Available in Chrome with origin trial token Contributors in Munich, NY, Prague, Seattle, Zürich

slide-29
SLIDE 29

2019 |

Resources

  • Early adopters: trusted-types@googlegroups.com
  • Specification: github.com/WICG/trusted-types
  • "Securing the Tangled Web" by C. Kern, ACM Queue 2014

@mvsamuel (Ask me about tools integration)