0

I'm to perform a security audit on the Drupal 8 Core modules, and was curious if there were any telltale signs of Entry Points (ie, how a module communicates with an external module and vice-versa).

OWASP defines an Entry Point as "the interfaces through which potential attackers can interact with the application or supply it with data."

I assume this is not very different from Entry Points of standard web applications (forms, HTTP packets, etc.), but I am interested in knowing whether or not Drupal has its own standard as to where these Entry Points are located. Are there specific snippets of code I should be looking for?

I do intend on reviewing the modules manually and in-depth, but figured someone on here may have some advice to help lessen the steep learning curve.

Any and all help is appreciated!

Cheers! :)

Improve this question
4
  • 1
    Not meant as an attack in any way, but I'm not sure why you would need to do a full security audit yourself. That seems like a task that a) is going to take a huge amount of time and b) would require to be done by someone who is very experienced in Drupal to be meaningful. Drupal has a security team, all new code especially in Drupal Core is extensively reviewed and any issues that are found (which does happen from time to time) are handled responsibly. See drupal.org/drupal-security-team/general-information and the other pages there
    – Berdir
    Sep 5, 2017 at 22:18
  • 1
    See also drupal.org/docs/8/security/writing-secure-code-for-drupal-8 and drupal.org/docs/7/security/writing-secure-code/overview
    – Berdir
    Sep 5, 2017 at 22:20
  • @Berdir I appreciate the feedback, but Drupal's Security Team does not seem to review Core unless there is a reason to do so (ie someone reports a vulnerability). From the link in your first comment: "Members of the security team sometimes perform analysis of core or contributed project code, especially if there is a weakness that can be found by easy scanning, but in general, the team does not review core nor contributed code." Thank you for your help, though! :)
    – n0t_5o_paRan01d
    Nov 10, 2017 at 15:18
  • Yes, most code is maybe not specifically reviewed by the security team, but every single line that is added to Drupal core is reviewed, usually by several developers, and quite a few of those are on the security team. According to insight.sensiolabs.com/projects/…, we're talking about 180k lines of code, it would take years for a single person to review that all. (Note that the critical security issues found there are false positivies)
    – Berdir
    Nov 11, 2017 at 10:57

1 Answer 1

Reset to default
2

Entry points will equate to routes in Drupal.

Modules will normally define their routes in a YML file named MODULE_NAME.routing.yml, but routes can be defined programmatically as well, check out this article from Acquia about routes: https://dev.acquia.com/blog/coding-drupal-8/defining-and-altering-routes-in-drupal-8/22/03/2016/9891

Also the 'routing' table in the database lists all the paths and their corresponding routes (I believe all). Note the use of '%' and '{some_value}' to indicate dynamic route values.

Hope that gets you started.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.