Recent content in Posts on jub0bs.com
TL;DR ¶ Go has now standardised iterators. Iterators are powerful. Being functions under the hood, iterators can be closures. The classification of iterators suggested by the documentation is ambiguous. Dividing iterators into two categories, “pure” and “impure”, seems to me preferrable. Whether iterators should be designed as “pure” whenever possible is…
In this post, I challenge you to refactor a small Go function in such a way as to make it inlinable and free of bounds checks, for better performance. Disclaimer : this post assumes version 1.24.2 of the (official) Go compiler ; you may get different results with other versions of the Go compiler or with other implementations of the Go language. Function inlining & bounds-check elimination ¶ Some…
TL;DR ¶ Exported concrete error types are superior to sentinel errors. They can be more performant, cannot be clobbered, and promote extensibility. Third-party function errutil.Find is a powerful alternative to standard-library function errors.As . Setting the scene ¶ Imagine that you’re writing a package named bluesky whose purpose is to check the availability of usernames on Bluesky , the…
TL;DR ¶ Some of the wisdom contained in Josh Bloch’s Effective Java book is relevant to Go. panic and recover are best reserved for exceptional circumstances. Reliance on panic and recover can noticeably slow down execution, incurs heap allocations, and precludes inlining. Internal handling of failure cases via panic and recover is tolerable and sometimes beneficial. Abusing Java exceptions…
TL;DR ¶ jub0bs/cors v0.5.0 now lets you handle CORS-configuration errors programmatically. This feature should be of interest to you if you’re a multi-tenant service provider and you let your tenants configure CORS for their instances. jub0bs/cors’s commitment to configuration validation ¶ One long-standing and distinguishing feature of jub0bs/cors is extensive configuration…
TL;DR ¶ In this short follow-up to my previous post , I describe why and how I’ve added support for dynamic reconfiguration of CORS middleware in jub0bs/cors . Rethinking configuration immutability ¶ Up until recently, I had been vehemently arguing that CORS middleware should not be reconfigurable on the fly and that any change to their configuration should require a server restart: Insofar…
TL;DR ¶ I’ve just released jub0bs/cors , a new CORS middleware library for Go , perhaps the best one yet. It has some advantages over the more popular rs/cors library, including a simpler API , better documentation , extensive configuration validation , a useful debug mode , stronger performance guarantees . Here is a representative example of client code: package main import ( 'io' 'log'…
TL;DR ¶ A few months ago, while hunting on a public bug-bounty programme, I found a nice little bug chain that involved an insecure message event listener, a shoddy JSONP endpoint, a WAF bypass, DOM-based XSS on an out-of-scope subdomain, a permissive CORS configuration, all to achieve CSRF against an in-scope asset. Read on for a deep dive about it. Be aware that I’ve redacted some…
TL;DR ¶ In this post, I investigate why developers struggle with CORS and I derive Fearless CORS , a design philosophy for better CORS middleware libraries, which comprises the following twelve principles: Optimise for readability Strive for a simple and cohesive API Provide support for Private Network Access Categorise requests correctly Validate configuration and fail fast Treat CORS as a…
TL;DR ¶ In this post, I present an XSLeak technique that allows an active network attacker to observe, from an insecure Web origin, the presence or absence of some Secure cookie that may have been set by the origin’s secure counterpart. Cookies’ crumbly beginnings ¶ Netscape ( Lou Montulli , more precisely) invented cookies in 1994 in order to introduce persistent client state in the…
James Kettle ’s 2016 research was instrumental in raising awareness of the deleterious effects of CORS (Cross-Origin Resource Sharing) misconfiguration on Web security. Does the story end there, though? Is writing about CORS-related security issues in 2022 futile? I don’t think so. This post is the first in a series in which I will discuss more minor CORS-related issues and present…
This post is a writeup about CVE-2022-21703 , which is the result of a collaborative effort between bug-bounty hunter abrahack and me. If you use or intend to use Grafana, you should at least read the following section. CVE-2022-21703 in a nutshell ¶ About Grafana ¶ Grafana is a popular open-source tool that describes itself thus: Grafana allows you to query, visualize, alert on and understand…
In this post, I show how a malicious member of a Slack workspace can exploit a cross-site leak in Slack’s file-sharing functionality in order to efficiently de-anonymise fellow workspace members when they visit the attacker’s website in Chromium-based browsers. TL;DR ¶ I discovered a navigation-related XSLeak technique that resists SameSite=Lax . Slack’s Web client suffers from a…
My third guest post on Honeybadger ’s blog, entitled Subdomain Takeover: Ignore This Vulnerability at Your Peril has just been published !
In this post, I dissect a common misconception about the SameSite cookie attribute and I explore its potential impact on Web security. TL;DR ¶ The SameSite cookie attribute is not well understood. Conflating site and origin is a common but harmful mistake. The concept of site is more difficult to apprehend than meets the eye. Some requests are cross-origin but same-site. SameSite only has effects…
My second guest post on Honeybadger ’s blog, entitled Protecting Your Apps From Link-based Vulnerabilities: Reverse Tabnabbing, Broken-Link Hijacking, and Open Redirects has just been published !
TL;DR ¶ To familiarise myself with the updated design draft on Type Parameters in Go, I wrote a generic implementation of a bidirectional map. You can try it out in this playground . Edit (2022-04-03): Now that Go 1.18 is out, I’ve spruced up this post a bit. Generics are coming to Go ¶ Support for parametric polymorphism (also colloquially known as “generics”) in the Go language…
A server-side request forgery (SSRF) is a type of vulnerability that consists in tricking a server into sending network requests to unintended hosts. In some cases (e.g. Scott Helme ’s Security Headers tool ), allowing users to trigger HTTP requests from some backend to arbitrary hosts is a feature. In many other cases, though, it is a serious security bug that may enable attackers to wreak…
I recently stumbled upon a critical instance of broken-access control , and I thought its story would make for an interesting blogpost. I’ve deliberately omitted some details (e.g. irrelevant HTTP headers) in the interest of simplicity and concision. Morever, all clues to the identity of the organisation I was hacking have been expunged from this post, for obvious reasons. A bit about the…
My first guest post on Honeybadger ’s blog, entitled Plugging Git Leaks: Preventing and Fixing Information Exposure in Repositories has just been published !
(This post is also available in French on Human Coders' blog .) About two weeks ago, I had the privilege to attend dotGo 2019 , the fifth edition of the European Go Conference. Whereas tech conferences I’ve attended in the past tended to be held in soulless hotels or convention centres, the dotGo team went all out and managed to secure the prestigious Théâtre de Paris, on rue Blanche, as a…
Go supports multiple programming paradigms, including object orientation. However, if you’re coming to Go from Java, you may be slightly… ehm… disoriented . One striking absence is that of any access modifiers. You may be wondering: Where are my public , protected , and private keywords? What mechanisms for access control does Go provide? Fret not! Access control in Go is…
defer , in a nutshell ¶ When learning Go, one quickly comes across the defer keyword. For instance, the Tour of Go introduces defer thus: A defer statement defers the execution of a function until the surrounding function returns. The deferred call’s arguments are evaluated immediately, but the function call is not executed until the surrounding function returns. package main import 'fmt'…