Courtesy: Yuri Samoilov, Flickr

Grails comes packaged with several application security gems. However, by default some of these features are not enabled. This is especially the case in older versions (2.2.x) of the Framework. 

In this blog post I will review six features that can help support your efforts to protect your application. If you have access to +lynda.com, I also highly recommend the Web Security course by +Kevin Skoglund. 

Security Tips:

1. Define allowed request types for all actions
2. Explicitly specify domain properties to be updated
3. Turn on HTML encoding by default (older versions)
4. Define constraints for each field of a domain
5. Use named or positional parameters in queries
6. Use the Spring Security Plugin

Tip #1: Define allowed request types for all actions

By default when you create a new controller in Grails, only the save, update, and delete methods have the allowed request type defined.  You want to extend this map to include all of the methods in your controller so that you establish expectations for request methods.  If someone attempts to access a method through another request type they may be trying to bypass your security.

Tip #2: Specify domain properties to be updated

Most examples in the documentation show Grails domain objects being updated by setting the parameter map to the properties of the object.  This can pose a security risk because you are allowing any parameters that match fields in the domain class to be updated; even if those fields were not present in your gsp page.  A better approach would be to explicitly specify which fields of the domain object you want to allow the user to update.

 

Do this:

def save() {
    def b = Book.get(params.id)
    b.properties['title', 'numPages'] = params
    b.save()
}

Not this:

def save() {
    def b = Book.get(params.id)
    b.properties = params
    b.save()
}

Tip #3: Turn on HTML Encoding by default 

grails.views.default.codec='none'

grails.views.default.codec='html'

I know this may seem obvious, but making sure you have the appropriate constraints defined will help protect your database.  For example, if you are storing a US zip code in your database; you wouldn’t accept values that do not equal 5 characters.  Further, you wouldn’t accept a negative value would you?  Of course not, so by having the constraints in place you avoid having to go back and clean up data later.  This is just one more layer of protection.

Tip #5: Use named or positional parameters in queries

This helps to protect your app from SQL Injection attempts.  That’s where a nefarious person will attempt to gain access to information in your database that they have no rights to.  Or they could possibly update/delete tables using this method.  There is tons of delightful reading on the subject on the OWASP site.

Tip #6: Use the Spring Security Plugin

Resources:

• http://grails.org/doc/2.2.4/guide/single.html#xssPrevention
• http://www.acunetix.com/websitesecurity/cross-site-scripting/
• https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)