Chapter 2: Common Software Weaknesses - Engineering Secure Software Systems: Research and Practice

2.1 Introduction¶

Recall from our previous chapter, that knowledge is one of the three pillars of security. In this chapter, we will explore some of the most common software weaknesses that can lead to security vulnerabilities. Understanding these weaknesses is crucial for developers, security professionals, and anyone involved in software development.

CWE: Common Weakness Enumeration¶

The Common Weakness Enumeration (CWE) is a community-developed list of software and hardware weaknesses. It is maintained by the MITRE Corporation and is widely used in the software security industry to identify and categorize common software weaknesses. The CWE list is organized into categories and subcategories, making it easier to understand the relationships between different types of weaknesses. You can explore the CWE list at cwe.mitre.org.

The

Deadly Sins of Software Security¶

CWE-79 - Cross-Site Scripting (XSS)¶

What is XSS?¶

Cross-Site Scripting (XSS) occurs when an application takes untrusted input and renders it back into a web page without validation or sanitization. This allows an attacker to inject malicious JavaScript code that executes in the victim’s browser.

Reflected XSS: The malicious payload is part of the request (e.g., query string) and reflected immediately in the response. Exploitation often requires social engineering (e.g., sending the victim a crafted link).
Stored XSS: The malicious payload is stored (e.g., in a database, as a blog comment). Anyone viewing the page later becomes a victim. This is typically more dangerous.

Demonstration: Vulnerable Flask App¶

# app.py
from flask import Flask, request, render_template
app = Flask(__name__)

@app.route("/")
def index():
    name = request.args.get("name", "World")
    return render_template("hello.html", name=name)

# hello.html
<h1>Hello {{ name }}</h1>

If the attacker visits:

http://localhost:5000/?name=<script>alert('Hacked!')</script>

…the browser executes the injected script.

Mitigation¶

Escape special characters: Convert < to <, > to >, etc. so that browsers treat input as plain text.
```
import html
safe_name = html.escape(name)
return render_template("hello.html", name=safe_name)
```
Use template engines correctly: Many frameworks (e.g., Jinja2 in Flask) automatically escape variables if the template extension is .html. If developers bypass or disable escaping, they reintroduce risk.
Validate inputs: Ensure that input conforms to expected formats (e.g., usernames, emails).