Here is a list of things concerning hybris security that I've done on my projects :
First read documentations
Below links are full of resources and details about security in hybris.
XML parser
We often need to import data from xml.
All Sax parser should use below features :
It allows to
- instructs the implementation to process XML securely. This may set limits on XML constructs to avoid conditions such as denial of
service attacks.
- do not include external general entities.
- do not include external parameter entities or the external DTD subset
- throw a fatal error if the incoming document contains a DOCTYPE declaration
JSON
All input must be validated using the OWASP lib json-sanitizer. See https://www.owasp.org/index.php/OWASP_JSON_Sanitizer
Example :
String wellFormedJson = JsonSanitizer.sanitize(jsonData);
try
{
return new ObjectMapper().readValue(wellFormedJson, JsonNode.class).toString();
}
catch (final IOException ex)
{
LOG.error("Incorrect json data : " + wellFormedJson, ex);
}
LOG
String coming from outside the application must not be directly logged to prevent log injection.
Controller case
In web context all controllers must extends BaseController. This class contains the method logParam which should be used to log something unknown.
This method uses YSanitizer.sanitize(input).
public class YSanitizer
{
public static String sanitize(final String input) {
String output = StringUtils.defaultString(input).trim();
output = output.replaceAll("(\\r\\n|\\r|\\n)+", " ");
output = StringEscapeUtils.escapeHtml(output);
return output;
}
}
Other case
Calling StringEscapeUtils.escapeJava(valToLog) should be enough.
Protect sensitive data from heap inspection
Because heap can be inspected, sensitive data should not be stored in String objects.
Indeed Strings are immutable and can stay in the heap for a while.
To prevent this issue all sensitive strings must be stored in a char[].
This array should be filled with "0" as soon as possible (when the value is not needed).
Not that this method is not 100% safe but reduced the time window to find the password in the heap.
Cross-Site Scripting (XSS)
Make sure de.hybris.platform.servicelayer.web.XSSFilter is in the filters list of incoming requests
- Verify that the default passwords for all users have been changed
- Change admin user password for production
- Disable automatic login or pre-populated passwords for
- Product cockpit
- CMS cockpit
- CS cockpit
- hMC
- Password encoding should be MD5 or better SHA256
- Change default password encoder
- Change SALT for MD5 and SHA256 password encoder
- Verify the database password and the requirement to store them in plain text in local.properties.
- Verify that user account and checkout pages are only accessiable via a secure SSL connection
- Check that a Web application firewall is in place
- Perform a code review to ensure that no sensitive data, like credit card information or passwords, are logged to the log file
- Verify that the hybris application server is not running as root
- Secure the JMX connected
