ladies and gentlemen next presentation
today is Mr Thomas
okay thank you
uh I welcome you to the least
uh security talk on this conference
uh
it will be mostly about instant upgrades
because that's uh that's what I do and I
would like to show you how instant
upgrades are actually related with the
security topic
uh I came from Prague from Czech
Republic
and my field of focus is mostly PHP
uh can I ask with somebody here working
with PHP
perfect one to two people good so
basically this talk is generally about
PHP but the idea is rather about any
language that can be analyzed or parsed
so at first I have a confession to make
I'm like no secret expert so don't take
any security advice for me I think I'm
the least
skilled person here including all the
stuff
but
my focus is software reconstructions and
often with the software reconstructions
we Face something that's very old and
broken and maybe in a way insecure and
our job is trying to make it more modern
stable and useful
uh
can I maybe ask you like just about the
language of
somebody from JavaScript area
or go
or Java
or c
is anybody here a coder
good good so what other languages that
you work with usually
C sharp okay
Java hit
so maybe like from C or C sharp there
will be something related with AST
uh with any language that you use we
usually face something that's uh
I released in a new version especially
in PHP we have this release schedule
that we have a release every year maybe
something that's similar in in Java not
sure
and this is actually a screenshot from
the last conference I gave talk before
covet
and in that time we have this like red
versions that are not secure you should
not use them only if your business is
making a lot of money then it's safe to
use them
uh and this is screenshot from today
and if you compare them in a three years
basically all the useful versions that
were before save seven three are now all
red
but I think only people only in this
conference care about it like most of
the clients they just don't care if it's
red or green just if it makes money it's
okay
and not only that but on the languages
we have Frameworks so there's another
level of complexity and code that can be
a legacy and again this is
something from the previous year and
basically all the versions that were
kinda legal the phone Port 3 are now
forbidden in three years so in three
years basically we'd have to rewrite
everything just to feel secure
so how to deal with this
well you can hire some like security
expert or upgrade expert or somebody who
knows how this language Works what's
unsafe there
and soon you will realize there's a
little bit more technologies that you
use and you need export for every single
field and every area and it does that's
quite costly and I think that's why
companies decide not to do anything
until it really breaks
so this is a saying from coding area
basically once you start coding the
thing that you created today the next
month is already deprecated or not
useful anymore
and you need to rewrite it or upgrade it
but I think the same is going with uh
security and the knowledge once you
learn something here
you go back to your company and you will
have to change the stuff that you learn
here
and that's great but it's also pretty
time consuming so the bigger your
project is and the more you learn here
the more work you will have tomorrow or
on Monday
which is annoying
so
another thing from security is uh if you
make it complex enough maybe people will
not find out
but the same applies
if it's too complicated and complex we
are not able to understand it and we
cannot change it
and that's okay right
so we stay with this Legacy projects
that are huge and boring and hard to
upgrade and we think it's okay
so I wonder how can we do it better
apart educating ourselves in the
conference and trying to apply the
knowledge in our home project
uh we can use some tooling I would say
like do you know Snick
no snake Okay good few people so
basically snake is
very friendly tool that will help you to
discover security issues uh in your code
base you just run it in your code base
and it supports many many languages
uh I don't know which one because I
don't use it and uh
it finds some patterns that are insecure
and it tells you you have problem here
it's not that big problem but this is
kind of like security issue you should
fix that so you can actually put this
tool into your continuous integration or
deployment and you can find out how many
problems do you have
and this is not the only one you can you
can choose from many many tools like
this
and this is a
this kind of like core of this talk you
can automate the knowledge
that you find out here with a tool
that's like public publicly available
I would say like this knowledge is not
in the minds of the people but it's in
the tool so instead of teaching all your
colleagues they shouldn't do that you
just put the two into the CI and if the
CI fails they will know it's wrong and
you don't have to discuss with them in
the pull request about like if they're
secure or not because uh it will be red
and they will have to fix it
and that's something we actually apply
with uh with our clients when we try to
handle the upgrades because upgrades are
in a way making the projects more secure
so instead of doing it manually
if a client comes to us and asks us Hey
Thomas we have this 20 years old project
and we want to uh
let's say go for IPO or sell it but the
client is requirement we have to have a
secure version of PHP and servers and we
have this 10 years old PHP and they will
not buy it what can we do
so we try to help them to automate the
whole upgrade process because basically
making the project more secure or making
it upgraded it's just
a way of changing the patterns let's say
you have cross-site scripting it's very
well defined pattern that you can find
out and you can fix it
so if you make it a little more
technical just to
uh
give you idea do you know what's
abstract syntax tree
good good okay so basically uh I'm
working on an open source tool that's
running on abstract syntax tree and it
just just briefly who doesn't know it
goes through the code and it finds out
okay this is a class and it has these
properties and it has these types
and it can look for
alt code or insecure code
and if you know how old or insecure code
look like then you know how the goods
and new code look like so basically this
tool is defining
pattern refactoring
that you say this is a and this is B and
this is something I think C has
something like Clank Mr that's also like
this automated tool and I think
JavaScript has something like this so
there are many languages who already
have these tools and they are mostly
open source so it depends what's your
specific language
uh and what you need to do is like this
the language has to have the parser of
the code then you have to have static
analyzer the PHP is 10 and then you can
combine together and make it nice for
people to implement their own rules
okay now I'll show you very little demo
very little because there's just very
few uh PHP Developers
so I'll try to make it uh
short
external Mirror Mirror okay
I'll try to make it uh does this work
yeah can I change can I change to this
microphone
check check okay good thank you
okay okay
for a few seconds
hey
ah this one yeah
do you see it or should I yeah in the
back also
yeah good okay
let's see so basically this is a
in PHP have this dependency manager it's
probably in every tool in every language
you just ask for the dependencies that
your project
use this and then you have some tooling
that you can use to help you to maintain
the code to test it and so on
so Rector is basically just one of the
packages that you can install and uh
then you can Define in the config
just very briefly uh what path it should
scan and here you have defined rules and
this is something like uh the snake
that's using the ASD that I showed you
before
there is a specific rule that looks for
certain patterns and if it finds it then
it will change the code
so I have a just very simple
example how it looks like here we have
some
let's say alt or insecure code
uh
the thing is the thing I like about
automated refactoring that actually I
have no idea how the insecure and bad
code looks like because I just create
the rule or Community creates the rules
it becomes part of the set and then you
can use the set just to like make your
code better
so actually
a lot of Security Experts can connect
put each their own knowledge and then
you can use the knowledge of our
community
otherwise you would have to have it all
in your head
so here are some annotations you may be
none of them from java this is in PHP
it's still like comments so it's very
lousy
but in a
in a newer version
we already have a like proper proper
annotations like Java
and to make them change to a new one and
again this is this you can apply on a
hold code base so
it's as fast as your like software or
CPUs
so you can run it on the code
let's see dry run first
so if we run it we will see what it
tries to change
so this is something some in the older
or insecure syntax and it will try to
translate it into like better one
so if because it was a dry run it's
still not applied so now we run it
without dry run
we can see the goat
so I think
yeah
as you can see it transforms the code
and you don't have to have specific
knowledge about the transformation and
you just run the two with defined rules
and as you can see there are more rules
so more stuff that to be converted so we
just can enable more more sets
and
just let the tool handle the job
let's see
okay so now we have everything this is
supported from the next PHP version
so not yet so we have everything that we
can in our current version whether it's
PHP Java C C sharp
the most upgraded as we can so we don't
have to think about
learning what's new in this or that
version and so on
okay so that's for the demo
okay yeah
thank you
check check
I'll just do this
okay so uh
this way we can apply the tool whether
it's vector or something in your
language or Community but we can also
put it
no this one we can also put it in the CI
so let's say
some new bug is discovered and put into
a wasp and you don't know about it yet
but if you're using some tool that's
uh
implementing these security issues and
putting them into your CI
you can run it on the CI and you will
know about them as soon as possible and
not only you should know about them but
you can run two in your CI and let the
let the code fix for you of course the
merge and check is up to you but the big
Advantage is that you don't have to
check it yourself and you don't have to
worry about it
and that should be it
if I get there yeah okay thank you
[Applause]
it doesn't work yeah
uh questions yeah
yeah
thanks uh how does that recommendation
goes in the pr process so is that a code
suggestion or is that an output that you
need to go back to your workstation and
fix it there uh it's up to you there are
two ways like uh in in GitHub actions
let's say requests you can have like
these annotations that it will like
comment on your code which I think is
useful with tools like sneak they will
just plug them in and they will tell you
oh this this could be this could be
problem but uh
we actually tried this approach but most
people prefer to just have the
suggestion right in the comment so
basically you send a pull request and
instead of the tool forcing you to go to
your computer and fixing everything it
will propose the fix with the commit or
request to your request so then it's up
to you just to click or decline
cool and then I assume that then tests
are run after right so you know that it
didn't break anything yeah yeah yeah
okay that's important the test must pass
before and also after yeah yeah okay
cheers yeah
anybody else
don't be shy
thank you Thomas okay thank you great
job thanks for traveling down from
Prague right yeah yeah good job
okay thank you