Joomla Stack Exchange is a question and answer site for Joomla! administrators, users, developers and designers. It only takes a minute to sign up.
Sign up to join this community
Before I'm going to write my first extension, I would like to understand how to design it as invulnerable as possible.
Is there a set of rules to write safe Joomla extension?
I can imagine only SQL injection as possible threat so I know that form input can be never inserted directly to SQL command 'as is'.
What are other vectors of attack I should be aware of when writing custom module or plugin?
One main thing which you have pointed out is SQL Injection. This is one thing which a few people I've seen seem to miss completely and start developing using non Joomla coding standards and start writing SQL queires using mysql_* commands.
Second thing which I kind of mentioned in the first point, which is always stick to Joomla coding standards. The only time you shouldn't is when Joomla does not provide an alternative.
Thirdly, if you're extension creates a folder or file, then ensure you give them the correct permissions and do not start making folder chmod 777. This is the exact reason why K2 which is one of the most popular extensions out there was considered vulnerable and removed from JED temporarily.
Always use tokens with forms. This will ensure that no unauthorized attacks from other sites can be executed. For more information regarding this, have a look at the following:
http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms
If you're unsure of something having already run some tests, try popping along to the Code Review Stackexchange as there might be someone willing to check over your code for you.
One thing you can do is have a look at the Vulnerable Extensions List to see the extensions that have temporarily (until fixed) been removed from the Joomla Extensions Directory due to not being safe.
Hope this gives you a little insight and good luck with your first extension
Following the official documentation, here are some steps on the topic Secure coding guidelines:
Validate any data you get from the request (POST, GET, COOKIES, etc.). Don't trust the user and be as strict as possible. If you expect an integer, don't allow a string to be accepted.
File uploads - avoid, whenever possible, accepting file on public web pages. If you need to validate the file meta information and do all possible checks.
Constructing SQL queries - understand how SQL injections work but also how you handle database errors. The more errors you display, the more information you give about your database structure. Ideally you log errors but do not display them.
Secure forms by using a token
It is mostly safe for most extensions, However be very cautious on anything that may need to save/edit files, improper filtering or validation can create an entry point.
As long as you use JDatabase's API correctly you should be secure from sql injection as well. You can look at com_content or plg_system_loadpositon in a Joomla install to help figure out some of the finer points of various Joomla API's (since documentation is a bit hard to follow).
Also using the API's if they fail and some sort of vulnerability is used, the fix would probably end up being a core update (if its JDatabase, i can imagine a Joomla release within the hour if its discovery :D), rather then an update to your extension.
This is one major flaw of open source is that anyone intending to do harm has all the information needed to do so. If it is a closed extension (not publicly available) chances are there will never be a problem.
Lastly the more simple the extension is (less code) the more likely it is that it will be 'invulnerable'. As an extension grows there are many more places a slight mistake can happen to create an entry point.
