Chapter 28 — Application and software supply chain security: implementation I
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes"]
N1["28.1 Output encoding"]
N2["28.2 Authorisation"]
N3["28.3 Upgrading tmpl"]
N4["28.4 Implementing the gate"]
N5["28.5 Regression review"]
N6["28.6 Rollback plan"]
N7["Code review focus"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["28.1 Output encoding"]
N2["28.2 Authorisation"]
N3["28.3 Upgrading tmpl"]
N4["28.4 Implementing the gate"]
N5["28.5 Regression review"]
N6["28.6 Rollback plan"]
N7["Code review focus"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX082"]
[Learning outcomes]
|
v
[28.1 Output encoding]
|
v
[28.2 Authorisation]
|
v
[28.3 Upgrading tmpl]
|
v
[28.4 Implementing the gate]
|
v
[28.5 Regression review]
|
v
[28.6 Rollback plan]
|
v
[Code review focus]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes
You will (1) implement output encoding and authorisation checks in the application; (2) fix the tmpl advisory safely; (3) implement the dependency gate; (4) review implementation for regressions.
28.1 Output encoding
Cross-site scripting (CWE-79) happens when untrusted data is placed into pages without encoding for its context. The fixed tmpl version escapes attributes by default. Kwame also adds a test that renders synthetic rider names with special characters and checks they appear as text, not markup.
Context matters because the same character is dangerous in different ways in page text, attribute values and scripts. A quote mark is harmless in text but can end an attribute early; angle brackets matter in text but not inside a quoted attribute. Encoding for the right context, by default, removes the burden from each developer. The test with synthetic rider names checks that quotes and angle brackets in them arrive on the page as plain text.
28.2 Authorisation
Every endpoint calls a central authorisation function with the user's role and the resource owner. Checks happen on the server, aligned with OWASP Top 10:2021 A01 and ASVS access-control requirements.
A central function means one place to review and test instead of checks scattered through every handler. It compares the user's role and identity with the resource: a rider may view only their own tickets, support staff any ticket but no payment tokens. A handler that forgets to call the function is caught by a test that lists every endpoint and checks each one calls it. Server-side checks matter because hidden buttons in the browser do nothing to stop a scripted request.
28.3 Upgrading tmpl
The upgrade from 2.0.9 to 2.0.10 is small but changes one default. Tests catch two templates that relied on unescaped output for trusted icons; they are rewritten to use an explicit safe-markup helper reviewed by Ingrid.
The changed default was the fix, so templates relying on the old behaviour broke as intended. Rewriting them with an explicit helper makes the trust decision visible in the code. Ingrid's review confirms the icons come from Coastline's own files, not user input. Any future use of the helper needs the same check.
28.4 Implementing the gate
The dependency gate is a small CI step reading the lockfile and SBOM, calling the advisory feed and the name-similarity check, and applying the policy. Its own code is reviewed and tested.
Keeping the gate small makes it easy to read and test. It does not decide policy itself; it reads the policy file and reports which rule failed, so the error message tells developers exactly what to fix. Tests use synthetic lockfiles that should pass and fail. A bug in the gate could let flawed packages through silently, so it is treated as security-critical code.
28.5 Regression review
After the changes, a reviewer compares rendered pages before and after and runs the authorisation test suite.
Comparing rendered pages catches text that now appears escaped where it should be formatted, or markup that should be escaped but is not. The authorisation suite checks that each role still sees exactly what it should after the refactoring of handlers. Automated screenshots highlight differences, and the reviewer looks at each one rather than approving the whole set. Regressions found here are cheaper than complaints from riders, and the review is repeated for any change that touches templates or authorisation.
28.6 Rollback plan
Each release can be rolled back to the previous signed artifact within ten minutes.
Fast rollback lowers the cost of a mistaken release, which makes the team more willing to ship security fixes quickly. Because the previous artifact is already signed and its digest recorded, the deployment policy accepts it without a new build. Database changes are the hard part: migrations are written so the previous version still works with the new schema for at least one release. The rollback is practised in staging every month, so the ten-minute figure is measured rather than hoped for.
Code review focus
Reviewers check that new endpoints call the central authorisation function and that templates do not use the safe-markup helper without a comment explaining why the content is trusted. A simple search in CI lists every use of the helper for the reviewer.
Worked example
The tmpl upgrade ships three days after the advisory, faster than the 11 days of the original incident, because the gate flagged it immediately and tests made the change safe.
Synthetic case. Code changes and timings are synthetic.
Errors and limits
Explicit safe-markup helpers can be misused; restrict and review their use.
Exercises
- EX082 — XSS defence. What prevents cross-site scripting here? Rubric: 3 = context encoding by default; tests with special characters; 2 = partial; 1 = vague; 0 = none.
- EX083 — Upgrade issue. What did the tmpl upgrade break and how was it fixed? Rubric: 3 = two templates relying on unescaped icons; safe-markup helper; 2 = partial; 1 = vague; 0 = none.
- EX084 — Speed gain. Why was this fix faster than the original incident? Rubric: 3 = gate flagged at once; tests; 2 = partial; 1 = vague; 0 = none.
Synthesis
Implement defaults that encode and authorise, and upgrade with tests behind you.
Continue studying — chapter 28 of 50
← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →