Security hardening in nodejs
advance · Node.js — Server-side JavaScript
In the context of web security, Injection and Insecure Deserialization are critical vulnerabilities that allow attackers to manipulate your backend logic, access unauthorized data, or even take complete control of your server. 1. Injection Attacks Injection occurs when untrusted data is sent to an interpreter as part of a command or query. The interpreter is "tricked" into executing unintended commands. A. SQL Injection (SQLi) The most common form. It happens when user input is concatenated directly into a SQL query. The Flaw: SELECT * FROM users WHERE id = ' + userInput + ' The Attack: An attacker enters ' OR '1'='1 as their ID. The query becomes: SELECT * FROM users WHERE id = '' OR '1'='1' (returning every user in the DB). B. Command Injection Occurs when your code passes user-supplied data (forms, cookies, HTTP headers) to a system shell. Example: A Node.js app using child_process.exec to ping an IP provided by the user. The Attack: User inputs 8.8.8.8; rm -rf / . The server pings the IP and then attempts to delete the root directory. C. Prevention: The "Golden Rule" Never trust user input. Use Parameterized Queries (Prepared Statements). // SAFE: Using placeholders in pg or mysql2 db.query('SELECT * FROM users WHERE id =
', [userId]); 2. Insecure Deserialization Serialization is the process of turning an object into a format (like JSON or a Byte Stream) for storage or transmission. Deserialization is turning it back into an object. Insecure Deserialization happens when an application deserializes data from an untrusted source without proper validation. A. How it leads to RCE (Remote Code Execution) In some languages (like Java, PHP, or Python), the deserialization process can automatically trigger "magic methods" or constructors. If an attacker crafts a malicious serialized object, they can force the server to execute code the moment the object is "rehydrated." B. The Node.js Context ( node-serialize ) In Node.js, the most famous example involves the node-serialize library. It allowed Function Deserialization , meaning you could send a JSON object that contained a function string, and the server would execute it. Attack Payload: {"rce":"_$ND_FUNC$_function (){require('child_process').exec('ls /', ...)}()"} 3. Key Differences Feature Injection Insecure Deserialization Primary Target The Interpreter (SQL, Shell, LDAP) The Application's Logic/Object State Data Type Usually Strings Serialized Objects (Binary, JSON, XML) Common Result Data Leakage / Data Deletion Remote Code Execution (RCE) Fix Parameterized queries & Escaping Use safe formats (JSON) & Validate schemas 4. Best Practices for Prevention Use JSON.parse(): In Node.js, standard JSON.parse() is safe because it only creates data structures (objects/arrays) and does not execute code. Avoid libraries that allow function serialization. Input Validation: Use a schema validator like Zod or Joi to ensure the data you receive matches the expected structure. Principle of Least Privilege: Run your database and application with the minimum permissions required. A web app should never have root or DB_OWNER access. Avoid eval() : Never use eval() or new Function() with user-supplied strings. This is essentially an open invitation for Injection.