Security for applications
This page is for application creators who want their code as safe as the kernel around it. Each rule names the kernel feature that helps; the standards page maps them to the OWASP Top 10 (Security standards).
Contents
The rules
| Rule | Kernel help | Read |
|---|---|---|
| Check permissions in every view, server function, fetch and service | functions in module.php, hasAccessTo(), canRead() | Access control in code |
| Validate and cast all input | eZHTTPTool, module actions | Input validation and output escaping |
| Escape all output | |wash in templates | same |
| Protect POST forms | ezformtoken | Forms, CSRF protection and HTTP input |
SQL only with escaping and casts, or eZPersistentObject | escapeString() | Database access and SQL |
| Redirect only within the site | safe redirect checks | Safe redirects |
| Store uploads through the kernel | image and file datatypes; SVG sanitizer | SVG images |
| No inline scripts or styles | the Content Security Policy | Content Security Policy for your code |
| No secrets in code, payloads or logs | settings/override/ | Environment settings and secrets |
| Record security-relevant actions | the audit trail | Audit trail |
| Outgoing requests only to allowed hosts | the link check's private-network rule as a model | URLs and links |
Entry points to secure
Every way into your code needs its own check:
- module views (
module.phpfunctions plus your own checks for limitations); - ezjscore server functions (ezjscore does not check a policy for you);
- REST controllers (the framework authenticates; you authorize);
- fetch functions and template operators (templates can be called from anywhere);
- cronjobs, commands and queue handlers (run as the right user; validate stored input again).
Before you ship
- To do: Every entry point checked with a user who lacks the permission.
- To do: Every printed value escaped; no raw HTML from users.
- To do: Forms post with tokens; no state change on GET.
- To do: Uploads checked by type and size, stored through the kernel.
- To do: No secrets in the repository (
git log -psearched). - To do: Pages produce no reports in
var/log/csp.log. - To do: Errors do not show stack traces to visitors; debug output off in production.
- To do: Dependencies current; Composer packages pinned to maintained versions.
Reporting vulnerabilities
Vulnerabilities in Exponential are reported privately as SECURITY.md in the repository describes, not in public
issues (When something goes wrong). Give your own extension a SECURITY.md with a
private contact, too.
Related pages
- Security hardening
- 13. Security hardening (installation)
- Security and audit
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.