3.3 Abuser Stories - nus-mtp/sashimi-note GitHub Wiki

1. Malicious Payload

Issues Resolutions
As an abuser, I can inject malicious script into a markdown document Input sanitization should be done on the markdown document before it get passed to the browser's markup processor (which also render the document).
As an abuser, I can inject malicious SQL query to retrieve confidential information from the database Input sanitization should be done on the user's input before any SQL command get executed.
As an abuser, I can create a plugin to retrieve private information by accessing DOM element outside of my plugin. Plugins code should be sand-boxed and encapsulated an iframe.

2. Unauthorized Access

Issues Resolutions
As an abuser, I can view documents that are not meant for me by accessing a private URL. The request for viewing a document should be authenticated before returning the document back to the user.
As an abuser, I can run a brute-force attack on the login page to gain unauthorized access. The login mechanism should impose a artificial delay before the user can re-enter the login detail again. CAPTCHA should used used after multiple invalid login attempts.