Light

lirantal / awesome-nodejs-security Goto Github PK

View Code? Open in Web Editor NEW

2.6K 66.0 238.0 309 KB

Awesome Node.js Security resources

nodejs security cybersecurity web-security owasp vulnerabilities pentest infosec hacktoberfest

awesome-nodejs-security's Introduction

Hi, I'm Liran 👋

I wrote these two comprehensive deep-dive books on Secure Coding in Node.js to help developers master Node.js security with hands-on vulnerability review and remediation walkthroughs

Node.js Secure Coding: Defending Against Command Injection Vulnerabilities

_{Node.js Secure Coding: Defending Against Command Injection Vulnerabilities}

Node.js Secure Coding:Prevention and Exploitation of Path Traversal Vulnerabilities

_{Node.js Secure Coding: Defending Against Command Injection Vulnerabilities}

Software Engineer · Web Security Activist · Author

A GitHub Star, world-wide recognized for championing open source software and actively working within communities to inspire and lift other humans. Liran also received the OpenJS Foundation's Pathfinder for Security for his work on Node.js security. A JavaScript & Node.js software developer, building web applications and command-line tools. A web security activist , engaging in security research, software supply chain security, and regular contributor and project lead to OWASP Foundation projects. An avid member of the Node.js Foundation ecosystem security working group, dedicated to advancing Node.js security awareness and skill-set in the open source community. Developer Advocate at Snyk.

Awarded:

⭐️ 2023 GitHub Star
🏆 2022 OpenJS Foundation's Pathfinder Award for Security
⭐️ 2022 GitHub Star
⭐️ 2021 GitHub Star

Web Security Activism

Member of Node.js Foundation's Ecosystem Security working group
OWASP Project Member of NodeGoat
OWASP Project Lead for CWE Tool and CWE SDK
Author of npm Security Cheat Sheet
Author of Node.js Docker Security Cheat Sheet

My latest articles on the Snyk blog and my blog

2023-09-13 Vue.js Patterns: Using Vue.js 3 Composition API for Reactive Parent to Child Communication
2023-09-15 Securing Your Node.js Apps by Analyzing Real-World Command Injection Examples
2023-09-04 Generating presentation titles using OpenAI background jobs with Node.js, Express and Trigger.dev
2023-08-17 How to Process Scheduled Queue Jobs in Node.js with BullMQ and Redis on Heroku
2023-08-07 Configuration Decoded: Lesser-Known Tips for Working with env-schema in Node.js
2023-07-17 Introducing Changesets: Simplify Project Versioning with Semantic Releases
2023-07-08 Deploying a Fastify & Vue 3 Static Site to Heroku
2023-06-30 Avoid Fastify's reply.raw and reply.hijack Despite Being A Powerful HTTP Streams Tool
2023-06-23 An Introduction to Command Injection Vulnerabilities in Node.js and JavaScript
2023-05-22 How to generate an SBOM for JavaScript and Node.js applications
2023-02-25 Open Source activism with ReadyCodePush
2023-02-22 The security concerns of a JavaScript sandbox with the Node.js VM module
2023-01-24 How to add client-side search with PageFind to your Astro blog static website
2023-01-15 Advanced usage patterns for taking page element screenshots with Playwright
2022-12-28 5 "no experience needed" tips for building secure applications
2022-12-05 How to verify and secure your Mastodon account
2022-11-22 Enhance your command line with Warp
2022-11-22 Content creators web resources
2022-11-07 NPM security: preventing supply chain attacks
2022-10-28 Are you also validating a JavaScript URL using RegEx?
2022-10-21 Resources for Public Speaking and Conference CFP application
2022-10-14 How to add Playwright tests to your pull request CI with GitHub Actions
2022-09-29 Choosing the best Node.js Docker image
2022-09-01 The npm faker package and the unexpected demise of open source libraries
2022-08-17 Ruby gem installations can expose you to lockfile injection attacks
2022-08-04 A definitive guide to Ruby gems dependency management
2022-08-03 Slidev 101: Coding presentations with Markdown
2022-05-04 3 Jedi-inspired lessons to level up your JavaScript security
2022-03-16 peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine ⚠️
2022-03-14 Build a software bill of materials (SBOM) for open source supply chain security
2022-03-08 Celebrating amazing open source innovation from Ukraine 🇺🇦
2022-02-09 Join “The Big Fix” to secure your projects with Snyk and earn cool swag
2022-01-09 Open source maintainer pulls the plug on npm packages colors and faker, now what?
2021-12-13 The Log4j vulnerability and its impact on software supply chain security
2021-11-11 Best practices for containerizing Python applications with Docker
2021-11-09 How to effectively detect and mitigate Trojan Source attacks in JavaScript codebases with ESLint

Published Author

Essential Node.js Security

_{Essential Node.js Security}
_{Liran Tal}

Web Security: Learning HTTP Security Headers

_{Web Security: Learning HTTP Security Headers}
_{Liran Tal}

O'Reilly Serverless Security

_{O'Reilly Serverless Security}
_{Guy Podjarny, Liran Tal}

State of Open Source Security 2019

_{Snyk's State of Open Source Security 2019}
_{Liran Tal}

awesome-nodejs-security's People

Stargazers

Watchers

Forkers

omerlh reality9 naugtur travi 7h3pr0xy iarnaud belkacem oatovar animir bbhunter vinayasathyanarayana abd-elrazek sureshdev learn-knowlege voidp34r johangu fheras1 modulexcite farazmurtaza thegablemethod emuhedo rajenderdandyal gauravmehla micahhu pauly617 noivuduc akashsingh00 dipakchavda2912 rustan-id sanpanthera leetbox cpt-chewieeee opesanyaadebayo stackpoet alpereny gaboesquivel praharsh1109 mackowski marciopocebon tiandiyixian flamato theshuvo binsarjr netcode vchouhan ellerbrock unsecureio leonmelamud lewisardern shreegowtham27 handsofthecommunity jareechang greatnonso7 git04112019 mmg1 jun3p4rk xmrseo crackercat anujm4467 omindio b4r05 angelqs hazanasec abdelrahmanbadr marabesi wronghandedryan nthuong95 0xfatty lifa123 nieuport alexmenguy princedhimanz georgeben php-coder digit-rwanda lizheming ramsai924 addedjacky jcalan8907 dipanshu-765 tuan-t-nguyen tejaswiniu megatronga jkalio52 reza srinitechhub c0deur ietabhi mrzacsmith dwtcourses aldrinaj prajwals15 ivanb475 kooltheba dannyelpina alemagio kaulanab tiagoha doot0 thedevappsecguy

awesome-nodejs-security's Issues

Add a "Frameworks" section

Hey!
Thank you @lirantal for creating this neat list. Would it be possible to add a section framework, with links pointing to Express, Sails, Electron lists or resources? I can propose a draft for it if you like.

Thanks!

NodeJsScan

Just a heads up on NodejsScan, it seems that the link at https://ajinabraham.github.io/NodeJsScan is returning a 404. Should I open a PR replacing the current URL by https://github.com/ajinabraham/nodejsscan?

Add a section for recorded talks ?

I thought it would be nice to have a section for talks related to Node.js security. What do you think ? (I can PR a bunch of talks i have in favorite if you are ok with the idea).

Link is broken

Input/Output Validation
- [Input/Output Validation](#input-output-validation)

Hardened JavaScript

Would you be open to a change to include:

ses, a shim for “Hardened JavaScript” which creates sub-realm sandboxes (Compartment) and freezes all intrinsics shared between them?
LavaMoat which uses Hardened JavaScript to confine third-party dependencies (node_modules) using human-readable policies generated from static analysis?
Moddable which uses Hardened JavaScript to confine JavaScript programs on embedded systems?

Request: add VS Code supply chain issue of JavaScript extensions into incidents

Based on the work described here: https://snyk.io/blog/vulnerable-visual-studio-code-extensions-marketplace/

Request: add snync for dependency confusion tooling

Link to 'A Roadmap for Node.js Security' not working

It seems that the link to A Roadmap for Node.js Security is dead. The proposed link on #42 (comment) does work though. It might better be replaced in the documentation.

https://nodesecroadmap.fyi leads to 404

I'm not sure whether it's a temporary or we should remove it from the list.

Idea: would be nice to have a table list for the incidents

Right now the incidents are just a list.
Would be great to:

Have them sorted out in a table so it is easier to access links, names, etc
Include dates of each incident
Order them by date descending so newest is on top and is easier to find

Is companies section is ok for an Open source org ?

Hello @lirantal 👋,

Would it be ok to add NodeSecure to the companies section ? There is no vocation to create a legal structure but we put ourselves forward as an organization of developers working together in order to create security tools.

Maybe a new section ?

Best Regards,
Thomas

What about OpenSSF initiatives/tools?

I think could be cool to add links to some Open source initiatives like:

Scorecard
SLSA (and maybe also sigstore.. But I'm working on few things around that for Node so I may add it later).

Also not sure how to also put OSV ?

What do you think?

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.