FixVibe
Covered by FixVibehigh

I-API Ukuvuza Okubalulekile: Izingozi Nokulungiswa Kwezinhlelo Zokusebenza Zewebhu Zesimanje

Izimfihlo ezinamakhodi aqinile kukhodi engaphambili noma umlando wekhosombe zivumela abahlaseli ukuba bazenze amasevisi, bafinyelele idatha eyimfihlo, futhi babhekane nezindleko. Lesi sihloko sihlanganisa izingozi zokuvuza okuyimfihlo kanye nezinyathelo ezidingekayo zokuhlanza nokuvimbela.

CWE-798

Umthelela

Izimfihlo eziputshuzayo ezifana nokhiye be-API, amathokheni, noma izifakazelo kungaholela ekufinyeleleni okungagunyaziwe kudatha ebucayi, ukuzenza ongeyena wesevisi, kanye nokulahlekelwa kwezimali okukhulu ngenxa yokusetshenziswa kabi kwensiza [S1]. Uma imfihlo isizibophezele kunqolobane yomphakathi noma ihlanganiswe nesicelo se-frontend, kufanele ibhekwe njengesengozini [S1].

Imbangela

Umsuka wembangela ukufakwa kwemininingwane ebucayi ngokuqondile kukhodi yomthombo noma amafayela okulungiselelwa azinikele ngokulandelayo ekulawuleni inguqulo noma anikezwe iklayenti [S1]. Onjiniyela ngokuvamile okhiye bekhodi eqinile ukuze kube lula ngesikhathi sokuthuthukiswa noma ngephutha bafake amafayela we-.env emisebenzini yabo [S1].

Ukulungiswa kukakhonkolo

  • Zungezisa Izimfihlo Ezisengozini: Uma imfihlo iputshuziwe, kufanele ihoxiswe bese ishintshwa ngokushesha. Ukukhipha kalula imfihlo enguqulweni yamanje yekhodi akwanele ngenxa yokuthi ihlala kumlando wokulawula inguqulo [S1][S2].
  • Sebenzisa Okuguquguqukayo Kwendawo: Gcina izimfihlo ezintweni eziguquguqukayo zendawo kunokuzibhala kanzima. Qinisekisa ukuthi amafayela e-.env engezwa ku-.gitignore ukuze kuvinjelwe ukwenza ngephutha [S1].
  • Sebenzisa Ukuphathwa Okuyimfihlo: Sebenzisa amathuluzi okuphatha ayimfihlo azinikele noma izinsiza ze-vault ukuze ujove izifakazelo endaweni yohlelo lokusebenza ngesikhathi sokusebenza [S1].
  • I-Purge Repository History: Uma imfihlo ibizibophezele ku-Git, sebenzisa amathuluzi afana ne-git-filter-repo noma i-BFG Repo-Cleaner ukuze ususe unomphela idatha ebucayi kuwo wonke amagatsha nomaka kumlando wekhosombe [S2].

I-FixVibe iyihlolela kanjani

I-FixVibe manje ifaka lokhu kumaskeni abukhoma. I-Passive secrets.js-bundle-sweep ilanda izinqwaba ze-JavaScript yemvelaphi efanayo futhi ifanisa ukhiye owaziwayo we-API, ithokheni, namaphethini wokuqinisekisa anamasango e-entropy nawesibambindawo. Ukuhlola okubukhoma okuhlobene kuhlola isitoreji sesiphequluli, amamephu omthombo, i-auth kanye nezinqwaba zeklayenti ze-BaaS, kanye namaphethini omthombo we-repo we-GitHub. Ukubhalwa kabusha komlando we-Git kusalokhu kuyisinyathelo sokulungisa; Ukufakwa bukhoma kwe-FixVibe kugxile ezimfihlo ezikhona ezimpahleni ezithunyelwe, isitoreji sesiphequluli, nokuqukethwe kwe-repo kwamanje.