Using SVN makes your site extremely vulnerable • Hacker News Board

Re: Using SVN makes your site extremely vulnerable

#11

Post by chrismear » Wed, Sep 23, 2009, 10:51 AM UTC

AndrewDucker wrote: post #8

It's not actually clear to me what the problem is. Are they saying that people can read your code (not actually a problem for open source projects) or that they can update it and thus alter your site? The former doesn't seem so bad - the latter is obviously catastrophic. I wish I spoke Russian...

It's the former. Sure, it's not a problem if your code is already open-sourced, but plenty of people are working on things that aren't. And aside from code, you may have private data stored in your repository, such as API keys, or even just configuration information about your site setup that might help attackers.

Re: Using SVN makes your site extremely vulnerable

#12

Post by chrismear » Wed, Sep 23, 2009, 10:54 AM UTC

masklinn wrote: post #7

Sujan wrote: post #5

Using a working copy as your website is a pretty bad idea. That's what svn export is meant for.

. It's especially bad because svn puts a .svn in each directory. With e.g. mercurial or git, you can tuck the (visible) site in a subdirectory of the repo itself (project/pages), and the .hg/.git (project/.hg|project/.git) won't be accessible. Of course the best option is still to use exports and symlinks.

Of course, it's not too tricky to configure, say, Apache to block access to all the .svn directories:

http://www.subversionary.org/martintomes/preventing-access-t... http://blog.samdevore.com/archives/2006/05/01/hivelogic-prev...

Re: Using SVN makes your site extremely vulnerable

#13

Post by ionfish » Wed, Sep 23, 2009, 10:54 AM UTC

For your Apache config.

  # Disallow viewing of .svn and .git directory contents
  
    Order allow,deny
    Deny from all

Re: Using SVN makes your site extremely vulnerable

#14

Post by ErrantX » Wed, Sep 23, 2009, 10:54 AM UTC

hlidotbe wrote: post #9

Sujan wrote: post #5

Using a working copy as your website is a pretty bad idea. That's what svn export is meant for.

Using a working copy allows you to deploy your website faster and safer (only the changes gets transfered, you can have hooks to do some cleanup and rollbacks are almost free). I use Mercurial on all my websites (disabling access to .*/.hg of course) and never use FTP for anything.

one good idea I had was using a patch queue to insert database and other "secret" settings into a Mercurial pull.

So when I deploy updates to sites we pull and update the changes then merge a locally stored patch queue to reconfigure the settings.

Because the settings are locally stored on the server (not in the site root) there is no way for people to steal the details from the public mercurial server :D

Re: Using SVN makes your site extremely vulnerable

#15

Post by [deleted] » Wed, Sep 23, 2009, 10:55 AM UTC

hlidotbe wrote: post #9

Sujan wrote: post #5

Using a working copy as your website is a pretty bad idea. That's what svn export is meant for.

Using a working copy allows you to deploy your website faster and safer (only the changes gets transfered, you can have hooks to do some cleanup and rollbacks are almost free). I use Mercurial on all my websites (disabling access to .*/.hg of course) and never use FTP for anything.

[deleted]

Re: Using SVN makes your site extremely vulnerable

#16

Post by InclinedPlane » Wed, Sep 23, 2009, 10:56 AM UTC

AndrewDucker wrote: post #8

It's not actually clear to me what the problem is. Are they saying that people can read your code (not actually a problem for open source projects) or that they can update it and thus alter your site? The former doesn't seem so bad - the latter is obviously catastrophic. I wish I spoke Russian...

Just reading. This is actually pretty bad. Consider all of the passwords embedded in connection strings and all the other various secrets contained in the source AND configuration files for a standard website. Even if your site uses all open source software, you still don't want J. Random Hacker to have write access to your database, for example.

Re: Using SVN makes your site extremely vulnerable

#17

Post by est » Wed, Sep 23, 2009, 11:16 AM UTC

InclinedPlane wrote: post #3

tl;dr Don't accidentally leave an svn working copy available to the internet, it could be a security vulnerability.

tl;dr

http://yoursite.com/index.php

then

http://yoursite.com/.svn/text-base/index.php.svn-base

for source code!

Re: Using SVN makes your site extremely vulnerable

#18

Post by DrJokepu » Wed, Sep 23, 2009, 11:31 AM UTC

I'm no security expert but I'm not sure if I get it - assuming that your code is well written, how would exposing the source code and change history make it more vulnerable? By using this logic, every piece of open source software is "vulnerable". Security through obscurity is not really security.

I thought not checking in safety critical things such as passwords or keys into the repository tree is a standard practice. If it's not, it should be.

Re: Using SVN makes your site extremely vulnerable

#19

Post by maurycy » Wed, Sep 23, 2009, 11:35 AM UTC

DrJokepu wrote: post #18

I'm no security expert but I'm not sure if I get it - assuming that your code is well written, how would exposing the source code and change history make it more vulnerable? By using this logic, every piece of open source software is "vulnerable". Security through obscurity is not really security. I thought not checking in safety critical things such as passwords or keys into the repository tree is a standard practic…

It depends on what the threat is.

If the threat is finding vulnerability, then you are right. If the threat is leaking the source code to the competition, then it is a serious matter.

Also, keep in mind the deployed source code is different than just the source code; it usually contains things like the database credentials and such.

Re: Using SVN makes your site extremely vulnerable

#20

Post by DrJokepu » Wed, Sep 23, 2009, 11:42 AM UTC

InclinedPlane wrote: post #16

AndrewDucker wrote: post #8

It's not actually clear to me what the problem is. Are they saying that people can read your code (not actually a problem for open source projects) or that they can update it and thus alter your site? The former doesn't seem so bad - the latter is obviously catastrophic. I wish I spoke Russian...

Just reading. This is actually pretty bad. Consider all of the passwords embedded in connection strings and all the other various secrets contained in the source AND configuration files for a standard website. Even if your site uses all open source software, you still don't want J. Random Hacker to have write access to your database, for example.

Maybe the real security problem is embedding passwords and other various secrets in the source code?