Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New CS proposal: [Symfony_Cheatsheet] #1222

Open
oxygensend opened this issue Oct 29, 2023 · 6 comments
Open

New CS proposal: [Symfony_Cheatsheet] #1222

oxygensend opened this issue Oct 29, 2023 · 6 comments
Assignees
@oxygensend
Labels
ACK_OBTAINED Issue acknowledged from core team so work can be done to fix it. NEW_CS Issue about the creation of a new cheat sheet.

Comments

@oxygensend
Copy link
Contributor

What is the proposed Cheat Sheet about?

This cheat sheet aims to provide developers with essential guidelines and best practices for securing Symfony applications. It covers common security issues encountered in Symfony apps and offers practical solutions to mitigate these risks.

What security issues are commonly encountered related to this area?

  1. Cross-Site Scripting (XSS)
  2. Cross-Site Request Forgery (CSRF)
  3. Session Security
  4. SQL Injection
  5. Command Injection
  6. Open Redirection
  7. File Upload Vulnerabilities
  8. CORS Configuration
  9. Security Headers
  10. Security Misconfigurations
  11. Authentication
  12. Error Handling Disclosure
  13. API Rate Limiting
  14. Debug Mode
  15. Sensitive data/files
  16. Encryption
  17. Dependency Vulnerabilities

What is the objective of the Cheat Sheet?

The cheat sheet aims to empower developers with actionable security measures specific to Symfony applications. By following this cheat sheet, developers can enhance the security of their apps, ensuring protection against various threats.

What other resources exist in this area?

Symfony Documetation - contains detailed security-related features and configurations https://symfony.com/doc/current/index.html
@oxygensend oxygensend added ACK_WAITING Issue waiting acknowledgement from core team before to start the work to fix it. HELP_WANTED Issue for which help is wanted to do the job. NEW_CS Issue about the creation of a new cheat sheet. labels Oct 29, 2023
@jmanico
Copy link
Member

jmanico commented Oct 30, 2023

Cool idea

@szh
Copy link
Collaborator

szh commented Oct 31, 2023

Is there any data on how popular Symfony is among developers? If this is a well-used framework then I think it makes sense to have a cheat sheet for it.

@oxygensend
Copy link
Contributor Author

oxygensend commented Oct 31, 2023 •
edited

@szh I don't have any data, I suppose we can find it somewhere, but Symfony along with Laravel, which is based on Symfony components, are two the most popular PHP frameworks for web development. Symfony is slightly more popular and more ordered than Laravel in my regions

@szh
Copy link
Collaborator

szh commented Oct 31, 2023

Thanks for the background. I took a look at their repository and it seems quite active. I'm simply not familiar with the PHP community which is why I asked.

@oxygensend
Copy link
Contributor Author

oxygensend commented Nov 8, 2023 •
edited

I've started working on this cheatsheet, I'll share my pull request with you when it'll be done :)

@szh
Copy link
Collaborator

szh commented Nov 8, 2023

Awesome, thanks for keeping us posted @oxygensend

@oxygensend oxygensend mentioned this issue Nov 22, 2023
Merged
8 tasks
@mackowski mackowski added ACK_OBTAINED Issue acknowledged from core team so work can be done to fix it. and removed ACK_WAITING Issue waiting acknowledgement from core team before to start the work to fix it. HELP_WANTED Issue for which help is wanted to do the job. labels Nov 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@oxygensend oxygensend

Labels
ACK_OBTAINED Issue acknowledged from core team so work can be done to fix it. NEW_CS Issue about the creation of a new cheat sheet.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@jmanico @szh @mackowski @oxygensend