Yuav ua li cas tus neeg tawm tsam thiaj li ua tau malware los ntawm tsab ntawv sau yog qhov kev txhawj xeeb tseem ceeb rau kev ruaj ntseg rau cov ntawv thov niaj hnub no. Cov neeg ua txhaum cai cyber feem ntau vam khom cov txheej txheem zoo li a kev tawm tsam hla kev sau ntawv los yog ib tug Kev tawm tsam scripting hla qhov chaw txhaj cov code phem rau hauv cov nplooj ntawv web, pipelines, lossis cov tswv yim ntawm cov neeg siv. Yog tsis muaj kev tiv thaiv zoo, cov kev tawm tsam no tuaj yeem kis tau malware, nyiag cov ntaub ntawv rhiab heev, lossis ua rau tag nrho cov chaw ib puag ncig puas tsuaj. Yuav kom nyob nyab xeeb, cov neeg tsim khoom yuav tsum nkag siab yuav ua li cas tiv thaiv kev tawm tsam scripting hla lub xaib sim thiab siv cov kev coj ua coding ruaj ntseg uas txhawb nqa los ntawm cov cuab yeej scanning tsis siv neeg.
Kev Tawm Tsam Raws Li Tsab Ntawv Yog Dab Tsi?
Kev tawm tsam raws li tsab ntawv sau tshwm sim thaum tus yeeb ncuab siv tsab ntawv sau yooj yim los khiav cov lej phem rau ntawm lub hom phiaj. Hloov chaw ntawm kev siv cov qhov tsis zoo uas nyuaj, cov neeg tawm tsam vam khom cov lus sau xws li PowerShell, Bash, lossis JavaScript los ua kom cov haujlwm phem ua tau.
Piv txwv li, ib tsab ntawv PowerShell phem tuaj yeem rub tawm ransomware, ib tsab ntawv plhaub tuaj yeem rho tawm cov ntaub ntawv pov thawj, thiab ib qho kev tawm tsam hla kev sau ntawv hauv JavaScript tuaj yeem khiav cov lej tsis raug cai hauv browser. Qhov tseeb, ib qho Kev tawm tsam scripting hla qhov chaw yog ib qho ntawm cov kev tawm tsam raws li tsab ntawv feem ntau vim nws siv cov ntaub ntawv hauv web ib txwm los xa cov malware.
Cov xwm txheej no qhia tau tias cov neeg tawm tsam hloov cov ntawv sau txhua hnub mus ua riam phom li cas, ua rau kev tawm tsam raws li ntawv sau ua qhov txaus ntshai loj rau cov neeg tsim khoom thiab DevOps pab pawg.
Tus neeg tawm tsam tuaj yeem ua Malware los ntawm Script li cas?
Yuav teb tau li cas tus neeg tawm tsam thiaj li ua tau malware los ntawm ib daim script, peb yuav tsum saib cov txheej txheem. Cov neeg tawm tsam txhaj lossis ua cov code hauv ib daim ntawv thov kom nws khiav yam tsis muaj lub hom phiaj ntawm tus tsim tawm. Ib txoj hauv kev feem ntau yog los ntawm kev tawm tsam hla scripting lossis kev tawm tsam hla lub xaib scripting, qhov twg JavaScript phem raug ntxig rau hauv daim teb nkag, ncuav qab zib, lossis URL parameter. Thaum nplooj ntawv thauj khoom, daim script ua haujlwm hauv tus neeg raug tsim txom lub browser.
Piv txwv tsis muaj kev nyab xeeb:
If userInput muaj <script>alert('hacked')</script>, cov ntawv sau khiav hauv browser thiab tuaj yeem nyiag cov ncuav qab zib lossis cov cim sib tham.
Piv txwv ruaj ntseg:
Los ntawm kev siv textContent, cov lus qhia raug kho raws li cov ntawv nyeem, tsis yog cov lej ua haujlwm tau.
Txawm tias ib tsab ntawv luv luv xwb los kuj tuaj yeem ua rau muaj kev xa tawm tag nrho cov malware, yog vim li cas cov pab pawg yuav tsum kawm paub tiv thaiv kev sim tawm tsam hla lub xaib.
Yog vim li ntawd kawm paub ua li cas tiv thaiv kev tawm tsam scripting hla lub xaib kev sim ua yog qhov tseem ceeb. Txawm tias ib daim code luv luv tuaj yeem dhau los ua qhov nkag mus rau kev xa tawm tag nrho cov malware.
Hom Kev Tawm Tsam Cross Scripting
Thaum piav qhia kev tawm tsam hla kev sau ntawv cov txheej txheem, nws yog ib qho tseem ceeb uas yuav tsum faib lawv ua peb pawg tseem ceeb. Txhua hom Kev tawm tsam scripting hla qhov chaw muaj ib txoj kev ua haujlwm sib txawv, tab sis txhua yam tuaj yeem ua rau malware khiav hauv tus neeg raug tsim txom ib puag ncig.
Khaws XSS
- Cov ntawv sau phem raug khaws cia tas mus li hauv lub ntaub ntawv (piv txwv li, hauv tus neeg siv profile, lus tawm tswv yim, lossis cov lus hauv forum).
- Txhua zaus uas lwm tus neeg siv saib cov ntsiab lus ntawd, tsab ntawv sau ua haujlwm tau.
- Hom kev tawm tsam no muaj kev phom sij tshwj xeeb vim nws kis mus rau ntau tus neeg raug tsim txom yam tsis muaj kev siv zog ntxiv los ntawm tus neeg tawm tsam.
XSS uas cuam tshuam
- Cov ntawv sau los ntawm URL tsim los yog daim ntawv nkag.
- Tus neeg rau zaub mov qhia txog cov lus teb phem ncaj qha rau hauv cov lus teb.
- Cov neeg raug tsim txom ua rau muaj kev tawm tsam thaum lawv nyem rau ntawm qhov txuas phem.
XSS raws li DOM
- Qhov kev tawm tsam tshwm sim tag nrho rau sab neeg siv khoom los ntawm kev tswj hwm Document Object Model (DOM).
- Cov haujlwm JavaScript tsis muaj kev nyab xeeb (xws li
innerHTMLordocument.write) tuaj yeem tso cai rau cov lej txhaj tshuaj kom khiav ncaj qha hauv browser.
Txhua ntawm cov no Kev tawm tsam scripting hla qhov chaw cov hom tuaj yeem ua thawj kauj ruam hauv yuav ua li cas tus neeg tawm tsam tuaj yeem ua rau malware ua haujlwm los ntawm tsab ntawv sau, ua rau lawv muaj kev txhawj xeeb txog kev ruaj ntseg tseem ceeb rau cov neeg tsim khoom.
Tsis tas li ntawd xwb, kev siv cov lus qhia uas ntseeg tau zoo li Daim Ntawv Qhia Txog Kev Tiv Thaiv OWASP XSS pab cov pab pawg standardkev tiv thaiv ize. Yog li ntawd, cov neeg tsim khoom yuav tsum koom ua ke ob qho kev coj ua coding ruaj ntseg thiab kev luam theej duab tsis siv neeg hauv lawv pipelines kom sib xws tiv thaiv kev tawm tsam scripting hla lub xaib sim.
Piv txwv tiag tiag ntawm Malware los ntawm Scripts
Cov neeg tawm tsam tau siv cov txheej txheem raws li tsab ntawv hauv cov xwm txheej tiag tiag uas ua rau muaj kev puas tsuaj loj heev rau nyiaj txiag thiab lub koob npe nrov.
Magecart hauv E-Commerce
Cov pab pawg Magecart JavaScript phem uas tau txhaj tshuaj rau hauv daim ntawv them nqi online. Yog li ntawd, txhua tus neeg siv khoom uas tau nkag mus rau cov ntaub ntawv credit card tau raug nyiag lawv cov ntaub ntawv. Qhov no Kev tawm tsam scripting hla qhov chaw tau qhia txog yuav ua li cas ib tsab ntawv txhaj tshuaj tuaj yeem ua rau ntau txhiab tus neeg siv cuam tshuam.
Pob NPM phem
Qee cov pob khoom NPM suav nrog muab zais postinstall tsab ntawv uas tau ua tiav thaum cov neeg tsim khoom tau teeb tsa qhov kev vam khom. Yog li ntawd, malware tau rub tawm ncaj qha rau hauv cov chaw tsim khoom.
Cov rooj plaub no ua pov thawj tias yuav ua li cas tus neeg tawm tsam tuaj yeem ua rau malware ua haujlwm los ntawm tsab ntawv sau tsis yog kev xav, nws tshwm sim txhua hnub hauv hav zoov.
Yuav Ua Li Cas Tiv Thaiv Kev Tawm Tsam Scripting Cross Site
Yuav tiv thaiv kev tawm tsam scripting hla lub xaib cov kev sim, cov neeg tsim khoom yuav tsum siv cov kev coj ua coding ruaj ntseg ua ke nrog kev kuaj xyuas tsis siv neeg:
- Kev Tawm Tswv Yim thiab Cov Tso Tawm
Yuav tsum ntxuav cov ntaub ntawv uas cov neeg siv sau ua ntej muab tso rau hauv HTML. Cov tsev qiv ntawv zoo li DOMPurify ua rau cov txheej txheem no yooj yim dua. - Siv Txoj Cai Kev Ruaj Ntseg ntawm Cov Ntsiab Lus (CSP)
CSP headers thaiv cov ntawv sau hauv kab thiab txwv cov peev txheej, txwv qhov deb npaum li cas cov lej txhaj tshuaj tuaj yeem kis tau. - Tsis txhob ua tej yam txaus ntshai
Tsis sivinnerHTML,document.write, lossis cov API zoo sib xws uas ncaj qha ua cov ntaub ntawv tsis ntseeg siab. - Kev Ntsuas Tsis Siv Neeg hauv CI/CD
Ntxiv cov cuab yeej kev ruaj ntseg rau hauv pipelines kom ntes tau cov ntawv sau thaum ntxov. Qhov no ua kom cov lej tsis muaj kev nyab xeeb yeej tsis mus txog qhov tsim tawm.
Tsis tas li ntawd, cov pab pawg yuav tsum sib koom ua ke Kev taw qhia ntawm OWASP rau hauv kev tshuaj xyuas thiab pipelines kom sib xws tiv thaiv kev tawm tsam scripting hla lub xaib qhov tsis muaj zog.
Kev Tiv Thaiv Tsis Siv Neeg Hauv DevSecOps Pipelines
Kev tshuaj xyuas tes xwb tsis tuaj yeem tiv thaiv txhua yam kev tawm tsam hla kev sau ntawvYog li ntawd, kev ua haujlwm tsis siv neeg yog qhov tseem ceeb.
Xygeni txhawb zog pipelinelos ntawm:
- Tshawb xyuas cov chaw khaws cia rau JavaScript lossis cov ntawv sau plhaub uas tsis ruaj ntseg.
- Nrhiav cov pob khoom NPM tsis muaj kev nyab xeeb nrog cov ntawv sau zais cia.
- Kev thaiv sib koom ua ke thaum cov qauv XSS lossis cov cim qhia malware tshwm sim.
- Muab Kho Kom Zoo cov lus qhia kom cov neeg tsim khoom tuaj yeem hloov cov code uas muaj kev pheej hmoo nrog cov kev xaiv uas muaj kev nyab xeeb dua.
xaus
Thaum xaus, tus neeg tawm tsam tuaj yeem ua li cas rau malware los ntawm script yog ib lo lus nug uas muaj ntau cov lus teb hauv ntiaj teb tiag: Magecart, cov pob khoom NPM phem, thiab cov qauv code tsis muaj kev nyab xeeb ua pov thawj qhov kev pheej hmoo. A Kev tawm tsam scripting hla qhov chaw feem ntau yog thawj kauj ruam, tab sis qhov cuam tshuam tuaj yeem mus deb tshaj qhov browser pop-up.
Yuav kom nyob ruaj ntseg, cov neeg tsim khoom yuav tsum kawm paub yuav ua li cas tiv thaiv kev tawm tsam scripting hla lub xaib teeb meem nrog kev lees paub cov ntaub ntawv nkag, CSP, thiab kev luam theej duab tsis siv neeg.
Nrog Xygeni, koj tuaj yeem hloov kev tiv thaiv mus ua kev nqis tes ua. Pipelines yuav ntes tau cov ntawv sau tsis ruaj ntseg, cov lus zais, lossis kev vam khom, thaiv cov kev sib koom ua ke tsis muaj kev nyab xeeb ua ntej lawv ntaus cov khoom tsim tawm.
