deardaniel/secdata-raw huggingface dataset:
OWASP Secure Coding Cheat Sheets: Prototype Pollution Prevention Cheat Sheet

# Prototype Pollution Prevention Cheat Sheet

## Explanation

Prototype Pollution is a critical vulnerability that can allow attackers to manipulate an application's JavaScript objects and properties, leading to serious security issues such as unauthorized access to data, privilege escalation, and even remote code execution.

For examples of why this is dangerous, see the links in the [Other resources](#other-resources) section below.

## Suggested protection mechanisms

### Use "new Set()" or "new Map()"

Developers should use `new Set()` or `new Map()` instead of using object literals:

```javascript
let allowedTags = new Set();
allowedTags.add('b');
if(allowedTags.has('b')){
  //...
}

let options = new Map();
options.set('spaces', 1);
let spaces = options.get('spaces')
```

### If objects or object literals are required

If objects have to be used then they should be created using the `Object.create(null)` API to ensure they don't inherit from the Object prototype:

```javascript
let obj = Object.create(null);
```

If object literals are required then as a last resort you could use the `__proto__` property:

```javascript
let obj = {__proto__:null};
```

### Use object "freeze" and "seal" mechanisms

You can also use the `Object.freeze()` and `Object.seal()` APIs to prevent built-in prototypes from being modified however this can break the application if the libraries they use modify the built-in prototypes.

### Node.js configuration flag

Node.js also offers the ability to remove the `__proto__` property completely using the `--disable-proto=delete` flag. Note this is a defense in depth measure.

Prototype pollution is still possible using `constructor.prototype` properties but removing `__proto__` helps reduce attack surface and prevent certain attacks.

### Other resources

- [What is prototype pollution? (Portswigger Web Security Academy)](https://portswigger.net/web-security/prototype-pollution)
- [Prototype pollution (Snyk Learn)](https://learn.snyk.io/lessons/prototype-pollution/javascript/)

### Credits

Credit to [Gareth Hayes](https://garethheyes.co.uk/) for providing the original protection guidance [in this comment](https://github.com/OWASP/ASVS/issues/1563#issuecomment[PII_REDACTED]).
OWASP Secure Coding Cheat Sheets: Transport Layer Protection Cheat Sheet

# DEPRECATED: Transport Layer Protection Cheat Sheet

The Transport Layer Protection Cheat Sheet has been deprecated.

Please visit the [Transport Layer Security Cheat Sheet](Transport_Layer_Security_Cheat_Sheet.md) instead.
OWASP Secure Coding Cheat Sheets: Injection Prevention in Java Cheat Sheet

# Injection Prevention Cheat Sheet in Java

This information has been moved to the dedicated [Java Security CheatSheet](Java_Security_Cheat_Sheet.md#injection-prevention-in-java)
Damn Vulnerable GraphQL Application: requirements

aniso8601==7.0.0
attrs==22.1.0
bidict==0.22.0
certifi==2022.12.7
charset-normalizer==2.1.1
click==8.1.3
exceptiongroup==1.0.4
Flask==2.2.2
Flask-GraphQL==2.0.1
Flask-GraphQL-Auth==1.3.3
Flask-SocketIO==5.3.2
Flask-SQLAlchemy==3.0.2
gevent==22.10.2
gevent-websocket==0.10.1
graphene==2.1.9
graphene-sqlalchemy==2.3.0
graphql-core==2.3.2
graphql-relay==2.0.1
graphql-server-core==1.2.0
graphql-ws==0.4.4
greenlet==2.0.1
h11==0.14.0
idna==3.4
iniconfig==1.1.1
itsdangerous==2.1.2
Jinja2==3.1.2
MarkupSafe==2.1.1
packaging==22.0
pluggy==1.0.0
promise==2.3
PyJWT==2.0.1
pytest==7.2.0
python-engineio==4.3.4
python-socketio==5.7.2
requests==2.28.1
Rx==1.6.1
simple-websocket==0.9.0
singledispatch==3.7.0
six==1.16.0
SQLAlchemy==1.4.44
tomli==2.0.1
urllib3==1.26.13
Werkzeug==2.2.2
wsproto==1.2.0
zope.event==4.5.0
zope.interface==5.5.2
git+https://github.com/dolevf/flask-sockets@master
OWASP Cheat Sheet Series: requirements

Babel==2.16.0
certifi==2024.8.30
charset-normalizer==3.4.0
click==8.1.7
colorama==0.4.6
feedgen==1.0.0
ghp-import==2.1.0
idna==3.10
Jinja2==3.1.6
lxml==6.1.0
Markdown==3.8.1
MarkupSafe==3.0.2
mergedeep==1.3.4
mkdocs==1.6.1
mkdocs-material==9.5.42
mkdocs-material-extensions==1.3.1
packaging==24.1
paginate==0.5.7
pathspec==0.12.1
platformdirs==4.3.6
Pygments==2.19.2
pymdown-extensions==10.16.1
python-dateutil==2.9.0.post0
PyYAML==6.0.2
pyyaml_env_tag==0.1
regex==2024.9.11
requests==2.33.0
six==1.16.0
urllib3==2.6.3
watchdog==5.0.3
OWASP Cheat Sheet Series: SECURITY

# Security Policy

The OWASP Cheat Sheet Series is primarily documentation, but some in-scope examples include:

- Allows an attacker to run code in a reader’s browser via [our site](https://cheatsheetseries.owasp.org/) (XSS, open redirect, etc)
- Leaks GitHub Actions secrets
- Tampers with our build pipeline

The following are out of scope unless they are directly exploitable on the live site:

- Snippets that are intentionally vulnerable for demonstration
- Third-party dependencies (automatically handled by Dependabot)

## Reporting a Vulnerability

**Do not open public issues for new vulnerabilities**.

Instead, submit a private report including clear steps to reproduce and details about potential impact to:

- <jim.manico@owasp.org>
- <jakub.mackowski@owasp.org>
- <shlomo.heigh@owasp.org>
OWASP Cheat Sheet Series: Preface

# ![OWASPHeader](assets/Preface_Cheatsheet_Header.png)

![ProjectLogoOfficial](assets/Preface_Cheatsheet_Logo.png)

The **OWASP Cheat Sheet Series** was created to provide a concise collection of high value information on specific application security topics. These cheat sheets were created by various application security professionals who have expertise in specific topics.

We hope that this project provides you with excellent security guidance in an easy to read format. :smile:

You can download this site [here](bundle.zip).

An ATOM feed is available [here](News.xml) with the latest updates.

Project leaders:

- [Jim Manico](https://github.com/jmanico)
- [Jakub Maćkowski](https://github.com/mackowski)

Core team:

- [Kevin W. Wall](https://github.com/kwwall)
- [Shlomo Zalman Heigh](https://github.com/szh)

Project links:

- [Homepage](https://owasp.org/www-project-cheat-sheets/)
- [GitHub repository](https://github.com/OWASP/CheatSheetSeries)
- [How to contribute?](https://github.com/OWASP/CheatSheetSeries/blob/master/CONTRIBUTING.md)
- [Logo](https://github.com/OWASP/owasp-swag/tree/master/projects/cheat-sheet-series)
OWASP Cheat Sheet Series: New CheatSheet

# `Topic` Cheat Sheet

**Replace `Topic` with the topic you're tackling, such as `Authentication` and remove this line**

```markdown
# Mandatory Markdown Format Rules

**!!! REMOVE THIS BLOCK BEFORE TO SUBMIT YOUR CHEAT SHEET VIA PULL REQUEST !!!**

- Use this [editor and validation policy](https://github.com/OWASP/CheatSheetSeries#editor--validation-policy).
- Use these [format rules](https://github.com/OWASP/CheatSheetSeries#conversion-rules).
```

## Introduction

Provide high level information about the topic in order to introduce it to people that do not know it.

You can add pointer to external sources if needed but at least give an overview allowing a reader to continue on the CS.

You can also add schema or diagram in any part of the CS but be sure to respect the copyright of the source file.

## Main Sections

The main sections will vary based on the content of the cheat sheet. Generally there should be no more than half a dozen level 2 sections in the cheat sheet, with subsections created for these as required.

## References

Any useful references to other useful resources that aren't linked inline elsewhere in the cheat sheet.
OWASP Cheat Sheet Series: Access Control Cheat Sheet

# DEPRECATED: Access Control Cheatsheet

The Access Control cheatsheet has been deprecated.

Please visit the [Authorization Cheatsheet](Authorization_Cheat_Sheet.md) instead.
OWASP Cheat Sheet Series: TLS Cipher String Cheat Sheet

# DEPRECATED: TLS Cipher String Cheat Sheet

The TLS Cipher String Cheat Sheet has been deprecated.

Please visit the [Transport Layer Security Cheat Sheet](Transport_Layer_Security_Cheat_Sheet.md) instead.
OWASP Cheat Sheet Series: Prototype Pollution Prevention Cheat Sheet

# Prototype Pollution Prevention Cheat Sheet

## Explanation

Prototype Pollution is a critical vulnerability that can allow attackers to manipulate an application's JavaScript objects and properties, leading to serious security issues such as unauthorized access to data, privilege escalation, and even remote code execution.

For examples of why this is dangerous, see the links in the [Other resources](#other-resources) section below.

## Suggested protection mechanisms

### Use "new Set()" or "new Map()"

Developers should use `new Set()` or `new Map()` instead of using object literals:

```javascript
let allowedTags = new Set();
allowedTags.add('b');
if(allowedTags.has('b')){
  //...
}

let options = new Map();
options.set('spaces', 1);
let spaces = options.get('spaces')
```

### If objects or object literals are required

If objects have to be used then they should be created using the `Object.create(null)` API to ensure they don't inherit from the Object prototype:

```javascript
let obj = Object.create(null);
```

If object literals are required then as a last resort you could use the `__proto__` property:

```javascript
let obj = {__proto__:null};
```

### Use object "freeze" and "seal" mechanisms

You can also use the `Object.freeze()` and `Object.seal()` APIs to prevent built-in prototypes from being modified however this can break the application if the libraries they use modify the built-in prototypes.

### Node.js configuration flag

Node.js also offers the ability to remove the `__proto__` property completely using the `--disable-proto=delete` flag. Note this is a defense in depth measure.

Prototype pollution is still possible using `constructor.prototype` properties but removing `__proto__` helps reduce attack surface and prevent certain attacks.

### Other resources

- [What is prototype pollution? (Portswigger Web Security Academy)](https://portswigger.net/web-security/prototype-pollution)
- [Prototype pollution (Snyk Learn)](https://learn.snyk.io/lessons/prototype-pollution/javascript/)

### Credits

Credit to [Gareth Hayes](https://garethheyes.co.uk/) for providing the original protection guidance [in this comment](https://github.com/OWASP/ASVS/issues/1563#issuecomment[PII_REDACTED]).
OWASP Cheat Sheet Series: Transport Layer Protection Cheat Sheet

# DEPRECATED: Transport Layer Protection Cheat Sheet

The Transport Layer Protection Cheat Sheet has been deprecated.

Please visit the [Transport Layer Security Cheat Sheet](Transport_Layer_Security_Cheat_Sheet.md) instead.
OWASP Cheat Sheet Series: Injection Prevention in Java Cheat Sheet

# Injection Prevention Cheat Sheet in Java

This information has been moved to the dedicated [Java Security CheatSheet](Java_Security_Cheat_Sheet.md#injection-prevention-in-java)
OWASP Software Assurance Maturity Model: tab contributing

---
title: Contributing
layout:  null
tab: true
order: 4
tags: samm
---

# Get Involved

Involvement in the development of SAMM is actively encouraged!

You do not have to be a security expert in order to help out.

We have written some guidelines on our OWASPP SAMM website on [how you can contribute to SAMM](https://owaspsamm.org/contributing/).


## Feedback

Please use the [Github Issues](https://github.com/OWASP/samm/issues/new) for feedback:

* What do like?
* What don't you like?
* How can we make SAMM easier to use?
* How could SAMM be improved?

### Help us translate!

Are you fluent in another language? Can you help translate SAMM into
that language?

You can use [Crowdin](http://crowdin.net/project/owasp-samm) to do
that\!
OWASP Software Assurance Maturity Model: tab sponsors

---
title: Sponsors
layout:  null
tab: true
order: 5
tags: samm
---

## Call for SAMM Sponsors

OWASP SAMM and the SAMM v2 release is the open source software
security maturity model used to develop secure software for IT,
application and software security technologists.

We are seeking sponsors to support OWASP SAMM. All proceeds from the
sponsorship support the mission of the OWASP Foundation and the further
development of SAMM. Supporting the project drives the funding for
research grants, SAMM hosting, tools, templates, documents, promotion,
and more.

By sponsoring SAMM, you not only support an important and flagship OWASP
project, you will also get visibility during the next SAMM User Conference 
and recognition on the OWASP SAMM [web site](https://owaspsamm.org/) and
the next releases of SAMM.

For more information: Contact <seba@owasp.org>

### Project Sponsors

{% include sponsors.md data=site.data.sponsors %}

#### Supporters

* [White Jaguars](https://www.whitejaguars.com/)
OWASP Software Assurance Maturity Model: index

---

layout: col-sidebar
title: OWASP SAMM
tags: samm
level: 4
type: documentation
pitch: A Software Assurance Maturity Model (SAMM) that provides an effective and measurable way for all types of organizations to analyse and improve their software security posture.
 
---

[![OWASP Flagship](https://img.shields.io/badge/OWASP-Flagship%20Project-48A646.svg)](https://owasp.org/projects/#div-flagships)
[![GitHub Release](https://img.shields.io/github/release/OWASP/SAMM)](https://github.com/OWASP/SAMM/releases)
[![Follow on Twitter](https://img.shields.io/twitter/follow/owaspsamm.svg?logo=twitter)](https://twitter.com/owaspsamm)

**Software Assurance Maturity Model**

Our mission is to provide an **effective and measurable** way for you to analyze and improve your **secure development lifecycle**. 
SAMM supports the complete software lifecycle and is **technology and process agnostic**. We built SAMM to be **evolutive and risk-driven** in nature, as there is no single recipe that works for all organizations.<br>
<br>

Check out the OWASP SAMM v2 model [online](https://owaspsamm.org/model/):<br>
<br>

[![SAMM Model](assets/images/OWASP-SAMM-model-800.png)](https://owaspsamm.org/model/)
<br>
<br>

**Get OWASP SAMM new delivered to your mailbox**
  - [Subscribe to our newsletter](https://owaspsamm.us9.list-manage.com/subscribe?u=b83ce65c91239cb5e623ea83e&id=cbd0520923)
    
**Join us on the OWASP SAMM project Slack channel**

  - [Join our project slack channel](https://owasp.slack.com/messages/C0VF1EJGH)
  - Invitations (self registration) via: <https://owasp.org/slack/invite>
    
**Join our monthly calls**

  - The monthly call is on each 2nd Wednesday of the month at 21h30 CET
    / 3:30pm ET.
  - Register through our [SAMM MeetUp](https://www.meetup.com/owasp-samm/) to join the Zoom call.
  - The call is open for everybody interested in SAMM or who wants to
    work on SAMM.


The Software Assurance Maturity Model (SAMM) is an open framework to
help organizations formulate and implement a strategy for software
security that is tailored to the specific risks facing the organization.
SAMM helps you:

  - **Evaluate an organization’s existing software security practices**
  - **Build a balanced software security assurance program in
    well-defined iterations**
  - **Demonstrate concrete improvements to a security assurance
    program**
  - **Define and measure security-related activities throughout an
    organization**

*Dell uses OWASP’s Software Assurance Maturity Model (Owasp SAMM) to
help focus our resources and determine which components of our secure
application development program to prioritize.*, (**Michael J. Craigue,
Information Security & Compliance, Dell, Inc.**)
OWASP Software Assurance Maturity Model: info

### Information
* <i class="fas fa-flag" style="font-size: 1.2em; color:#2ADA08;"></i><span style="font-size:1.0em;padding-left:12px;">Flagship Project</span>
* <i class="fas fa-book" style="font-size: 1.2em; color:#233e81;"></i><span style="font-size:1.0em;padding-left:12px;">Documentation</span>
* <i class="fas fa-toolbox" style="font-size: 1.2em; color:#233e81;"></i><span style="font-size:1.0em;padding-left:12px;">Builder</span> 
* <i class="fas fa-shield-alt" style="font-size: 1.2em; color:#233e81;"></i><span style="font-size:1.0em;padding-left:12px;">Defender</span>
* [Current Version 2.0.3 (2022)](https://owaspsamm.org/)

### SAMM v2 model
* See v2 [online](https://owaspsamm.org/model/)
* [SAMM
Toolbox](https://github.com/owaspsamm/core/releases/download/v2.0.3/SAMM_spreadsheet.xlsx)

### Slack
- [Join OWASP Slack](https://owasp-slack.herokuapp.com/)
- [Join our SAMM channel](https://owasp.slack.com/archives/C0VF1EJGH)

### Social Links
* [@owaspsamm](https://twitter.com/owaspsamm)
* [YouTube](https://www.youtube.com/channel/UCEZDbvQrj5APg5cEET49A_g)
* [Slack channel](https://owasp.slack.com/archives/C0VF1EJGH)
* [LinkedIn](https://www.linkedin.com/company/owasp-samm/)
* [Newsletter](https://owaspsamm.us9.list-manage.com/subscribe?u=b83ce65c91239cb5e623ea83e&id=cbd0520923)

### Code Repository
* [Github Repo](https://github.com/OWASPsamm/)

### Download v1.5
* [All SAMM v1.5 files
 (.zip)](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/OWASP_SAMM_v1.5.zip) 
* [SAMM Core
Model](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Core_V1-5_FINAL.pdf)
* [How-To
Guide](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_How_To_V1-5_FINAL.pdf)
* [Quick Start
Guide](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Quick_Start_V1-5_FINAL.pdf)
* [SAMM
Toolbox](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5_FINAL.xlsx)
* [SAMM Toolbox
Example](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.5/Final/SAMM_Assessment_Toolbox_v1.5-Example_FINAL.xlsx)

### Download v1.1.1
* [SAMM Core
Model](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Core_V1-1-Final-1page.pdf)
* [How-To
Guide](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_How_To_V1-1-Final-1page.pdf)
* [Quick-Start
Guide](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Quick_Start_V1-1-Final-1page.pdf)
* [Updated SAMM Tool
Box](https://github.com/OWASP/samm/raw/master/Supporting%20Resources/v1.1/Final/SAMM_Assessment_Toolbox_v1-1-Final.xlsx)
OWASP Software Assurance Maturity Model: sponsors

<div class="member-list">
  <div>
  {% for sponsor in include.data %}
    <a class="member-logo" href="{{ sponsor.url }}" rel="sponsored" target="_blank">
      <img src="{{ sponsor.image }}" alt="{{ sponsor.name }}" />
    </a>
  {% endfor %}
  </div>
</div>
OWASP Threat Modeling: .wordlist

ai
AIX
ajv
amd
antv
api
APIs
AppImage
ara
Atlassian
auth
backend
Backend
Bahasa
BCP
bitbucket
Bitbucket
Bluesky
BOM
Brasil
BrowserStack
CentOS
chai
chruby
ci
cli
CN
CMS
CodeQL
Config
cron
CVE
CVEs
CVSS
dast
DAST
dataflow
debian
Dependabot
Detectability
deu
Deutsch
dev
dmg
Dockerfile
dockerhub
DockerHub
DoS
dotenv
DotEnv
dropdown
eg
eng
env
ENV
español
FI
filesystem
FQDN
fra
français
frontend
Frontend
Gamification
github
Github
githubusercontent
gitlab
GitLab
gridlines
hin
hostname
https
HTTPS
IETF
Identifiability
IoT
Javascript
jekyll
JointJS
jpn
js
JS
json
JSON
jwt
JWT
JWTs
kubernetes
LINDDUN
Linkability
linux
localhost
LTS
MacOS
misconfigurations
mitigations
Mitigations
modelRef
ModelRef
msa
nav
npm
npx
NSIS
nvm
OAuth
openssl
orchestrator
OSX
owasp
OWASP
pdf
px
PNG
pnpm
por
português
postfix
pre
PRs
PWD
remediations
renderer
repo
repos
sast
SAST
SCA
Sinon
schemas
snapcraft
sudo
Suomi
SHA
SVG
SY
TBC
TBD
td
threatdragon
ThreatDragonModels
TLS
Trisqel
trivy
Trivy
TSV
UI
Uncheck
unpatched
uptime
URI
URLEncoded
UUID
Validator
vue
Vue
Webapp
webrick
www
yaml
zho
Integrations
LLMs
InfoSecOTB
LLM
LiteLLM
OWASP Threat Modeling: security

## Security Policy

If you find a vulnerability anywhere in this project, such as the source or scripts,
then please let the project admins know ASAP and we will fix it as a critical priority.

Open a [security advisory][advisory] which will be provided only to Threat Dragon's admins and in strict confidence.

[advisory]: https://github.com/OWASP/threat-dragon/security/advisories/new
OWASP Threat Modeling: README

# OWASP Threat Dragon Server

This is a Express project that is the back end server for the OWASP Threat Dragon website project

## Project setup

`npm install`

### Compiles and hot-reloads for development

`npm run dev`

### Compiles and minifies for production

`npm run build`

Clean the distribution with

`npm run clean`

### Run unit tests

`npm run test:unit`

For continuous testing:

`npm run test:unit -- --watch`

### Lints and fixes files

`npm run lint`
OWASP Threat Modeling: README

## Threat Dragon documentation

This docs directory provides the documentation site at `https://www.threatdragon.com/docs/`

The [owasp-td-jekyll](https://github.com/lreading/owasp-td-jekyll) theme provides
the header bar for the documentation site (such as flask, cloud etc).

### Running Locally

If you do not already have Jekyll or Ruby installed, see [Jekyll's Guide](https://jekyllrb.com/docs/installation/).

MacOS users should use chruby instead of the system ruby:

* From a terminal navigate to this `docs` directory
* Install/update bundle: `npm add --location=global bundle`
* Install jekyll, webrick etc: `bundle update`
* Run the docs server: `bundle exec jekyll serve`
* Navigate in a browser to server address: `http://127.0.0.1:4000/`

### Check for updates

It is good to note out-dated gem packages:

* `bundle outdated`
* `bundle update`
OWASP Threat Modeling: index

---
layout: home
title: OWASP Threat Dragon Docs
path: /
---

## Introduction

[Threat Dragon][td] is an open-source threat modelling tool from [OWASP][owasp].
Threat Dragon provides an environment to create threat models as
data-flow diagrams, along with associated threats and remediations.
The threats threats can be categorized using STRIDE, [LINDDUN][linddun],
CIA, CIA-DIE and [PLOT4ai][plot4ai].

Threat Dragon can be run as a containerized web application or as a desktop application.

The web application can store threat model files on the local file system; in addition access can be configured for :

- GitHub
- Github Enterprise
- Google Drive
- Bitbucket
- Bitbucket Enterprise
- GitLab

The desktop application saves the threat model files locally
with installers provided for MacOS, Windows and Linux.

Threat Dragon seeks to provide:

- Simplicity - you can install and start using Threat Dragon very quickly
- Flexibility - the diagramming and threat entry allows many types of threat to be described
- Accessibility - different types of teams can benefit from Threat Dragon's simplicity and flexibility

You can find the source code for Threat Dragon on [GitHub][repo],
where you can also ask for changes or report any issues.

----

Threat Dragon: _making threat modeling less threatening_

[linddun]: https://linddun.org/
[owasp]: https://owasp.org/
[plot4ai]: https://plot4.ai/
[repo]: https://github.com/OWASP/threat-dragon
[td]: https://owasp.org/www-project-threat-dragon/