-
Twig templates used for html generation
This is probably first on the list of anyone you ask about Drupal 8 security. This is also one of the most popular features with themers.
One security gain from this is that it enforces much stricter separation of business logic and presentation – this makes it easier to validate 3rd party themes or delegate pure presentation work. You can’t run SQL queries or access the Drupal API from Twig.
In addition, Drupal 8 enables Twig auto-escaping, which means that any string that has not specifically flagged as safe will be escaped using the PHP function htmlspecialchars() (e.g. the same as Drupal 7 check_plain()). Auto-escaping of variables will prevent many XSS vulnerabilities that are accidentally introduced in custom site themes and custom and contributed modules. That fact is why I ranked this as number one. XSS is the most frequent security vulnerability found in Drupal code. We don’t have a lot of hard data, but based on past site audits we generally assume that 90% of site-specific vulnerabilities are in the custom theme.
To see why themers love Twig, compare the Drupal 7 block.tpl.php code to the Drupal 8 Twig version.
Drupal 7 block.tpl.php:
Drupal 8 block.html.twig:
-
Removed PHP input filter and the use of PHP as a configuration import format
OK, maybe this should have been number one. Drupal 8 does not include the PHP input format in core. In addition to encouraging best practices (managing code in a revision control system like git), this means that Drupal no longer makes it trivial to escalate an administrator login to being able to execute arbitrary PHP code or shell commands on the server.
For Drupal 7, importing something like a View required importing executable PHP code, and for certain custom block visibility settings, etc. you would need to enter a PHP snippet. These uses of evaluated PHP (exposing possible code execution vulnerabilities) are all gone – see the next point about configuration management.
Now that we have covered the top two, the rest of the 10 are in rather arbitrary order.
-
Site configuration exportable, manageable as code, and versionable
The Configuration Management Initiative (CMI) transformed how Drupal 8 manages things that would have been represented in Drupal 7 as PHP code. Things like Drupal variables or ctools exportables (e.g. exported Views).
CMI uses YAML as the export and import format and the YAML files can be managed together with your code and checked into a revision control system (like git).
Why is this a security enhancement? Well, in addition to removing the use of PHP code as an import format (and hence possible code execution vulnerability), tracking configuration in code makes it much easier to have an auditable history of configuration changes. This will make Drupal more appealing and suitable for enterprises that need strict controls on configuration changes in place. In addition, configuration can be fully tested in development and then exactly replicated to production at the same time as any corresponding code changes (avoiding mistakes during manual configuration). Finally, it is possible to completely block configuration changes in production to force deployment of changes as code.
Read More 1001
Read More 1002
Read More 1003
Read More 1004
Read More 1005
Read More 1006
Read More 1007
Read More 1008
Read More 1009
Read More 1010
Read More 1011
Read More 1012
Read More 1013
Read More 1014
Read More 1015
Read More 1016
Read More 1017
Read More 1018
Read More 1019
Read More 1020
Read More 1021
Read More 1022
Read More 1023
Read More 1024
Read More 1025
Read More 1026
Read More 1027
Read More 1028
Read More 1029
Read More 1030
Read More 1031
Read More 1032
Read More 1033
Read More 1034
Read More 1035
Read More 1036
Read More 1037
Read More 1038
Read More 1039
Read More 1040
Read More 1041
Read More 1042
Read More 1043
Read More 1044
Read More 1045
Read More 1046
Read More 1047
Read More 1048
Read More 1049
Read More 1050
Read More 1051
Read More 1052
Read More 1053
Read More 1054
Read More 1055
Read More 1056
Read More 1057
Read More 1058
Read More 1059
Read More 1060
Read More 1061
Read More 1062
Read More 1063
Read More 1064
Read More 1065
Read More 1066
Read More 1067
Read More 1068
Read More 1069
Read More 1070
Read More 1071
Read More 1072
Read More 1073
Read More 1074
Read More 1075
Read More 1076
Read More 1077
Read More 1078
Read More 1079
Read More 1080
Read More 1081
Read More 1082
Read More 1083
Read More 1084
Read More 1085
Read More 1086
Read More 1087
Read More 1088
Read More 1089
Read More 1090
Read More 1091
Read More 1092
Read More 1093
Read More 1094
Read More 1095
Read More 1096
Read More 1097
Read More 1098
Read More 1099
Read More 1100
Read More 1101
Read More 1102
Read More 1103
Read More 1104
Read More 1105
Read More 1106
Read More 1107
Read More 1108
Read More 1109
Read More 1110
Read More 1111
Read More 1112
Read More 1113
Read More 1114
Read More 1115
Read More 1116
Read More 1117
Read More 1118
Read More 1119
Read More 1120
Read More 1121
Read More 1122
Read More 1123
Read More 1124
Read More 1125
Read More 1126
Read More 1127
Read More 1128
Read More 1129
Read More 1130
Read More 1131
Read More 1132
Read More 1133
Read More 1134
Read More 1135
Read More 1136
Read More 1137
Read More 1138
Read More 1139
Read More 1140
Read More 1141
Read More 1142
Read More 1143
Read More 1144
Read More 1145
Read More 1146
Read More 1147
Read More 1148
Read More 1149
Read More 1150
Read More 1151
Read More 1152
Read More 1153
Read More 1154
Read More 1155
Read More 1156
Read More 1157
Read More 1158
Read More 1159
Read More 1160
Read More 1161
Read More 1162
Read More 1163
Read More 1164
Read More 1165
Read More 1166
Read More 1167
Read More 1168
Read More 1169
Read More 1170
Read More 1171
Read More 1172
Read More 1173
Read More 1174
Read More 1175
Read More 1176
Read More 1177
Read More 1178
Read More 1179
Read More 1180
Read More 1181
Read More 1182
Read More 1183
Read More 1184
Read More 1185
Read More 1186
Read More 1187
Read More 1188
Read More 1189
Read More 1190
Read More 1191
Read More 1192
Read More 1193
Read More 1194
Read More 1195
Read More 1196
Read More 1197
Read More 1198
Read More 1199
Read More 1200
Read More 1201
Read More 1202
Read More 1203
Read More 1204
Read More 1205
Read More 1206
Read More 1207
Read More 1208
Read More 1209
Read More 1210
Read More 1211
Read More 1212
Read More 1213
Read More 1214
Read More 1215
Read More 1216
Read More 1217
Read More 1218
Read More 1219
Read More 1220
Read More 1221
Read More 1222
Read More 1223
Read More 1224
Read More 1225
Read More 1226
Read More 1227
Read More 1228
Read More 1229
Read More 1230
Read More 1231
Read More 1232
Read More 1233
Read More 1234
Read More 1235
Read More 1236
Read More 1237
Read More 1238
Read More 1239
Read More 1240
Read More 1241
Read More 1242
Read More 1243
Read More 1244
Read More 1245
Read More 1246
Read More 1247
Read More 1248
Read More 1249
Read More 1250
Read More 1251
Read More 1252
Read More 1253
Read More 1254
Read More 1255
Read More 1256
Read More 1257
Read More 1258
Read More 1259
Read More 1260
Read More 1261
Read More 1262
Read More 1263
Read More 1264
Read More 1265
Read More 1266
Read More 1267
Read More 1268
Read More 1269
Read More 1270
Read More 1271
Read More 1272
Read More 1273
Read More 1274
Read More 1275
Read More 1276
Read More 1277
Read More 1278
Read More 1279
Read More 1280
Read More 1281
Read More 1282
Read More 1283
Read More 1284
Read More 1285
Read More 1286
Read More 1287
Read More 1288
Read More 1289
Read More 1290
Read More 1291
Read More 1292
Read More 1293
Read More 1294
Read More 1295
Read More 1296
Read More 1297
Read More 1298
Read More 1299
Read More 1300
Read More 1301
Read More 1302
Read More 1303
Read More 1304
Read More 1305
Read More 1306
Read More 1307
Read More 1308
Read More 1309
Read More 1310
Read More 1311
Read More 1312
Read More 1313
Read More 1314
Read More 1315
Read More 1316
Read More 1317
Read More 1318
Read More 1319
Read More 1320
Read More 1321
Read More 1322
Read More 1323
Read More 1324
Read More 1325
Read More 1326
Read More 1327
Read More 1328
Read More 1329
Read More 1330
Read More 1331
Read More 1332
Read More 1333
Read More 1334
Read More 1335
Read More 1336
Read More 1337
Read More 1338
Read More 1339
Read More 1340
Read More 1341
Read More 1342
Read More 1343
Read More 1344
Read More 1345
Read More 1346
Read More 1347
Read More 1348
Read More 1349
Read More 1350
Read More 1351
Read More 1352
Read More 1353
Read More 1354
Read More 1355
Read More 1356
Read More 1357
Read More 1358
Read More 1359
Read More 1360
Read More 1361
Read More 1362
Read More 1363
Read More 1364
Read More 1365
Read More 1366
Read More 1367
Read More 1368
Read More 1369
Read More 1370
Read More 1371
Read More 1372
Read More 1373
Read More 1374
Read More 1375
Read More 1376
Read More 1377
Read More 1378
Read More 1379
Read More 1380
Read More 1381
Read More 1382
Read More 1383
Read More 1384
Read More 1385
Read More 1386
Read More 1387
Read More 1388
Read More 1389
Read More 1390
Read More 1391
Read More 1392
Read More 1393
Read More 1394
Read More 1395
Read More 1396
Read More 1397
Read More 1398
Read More 1399
Read More 1400
Read More 1401
Read More 1402
Read More 1403
Read More 1404
Read More 1405
Read More 1406
Read More 1407
Read More 1408
Read More 1409
Read More 1410
Read More 1411
Read More 1412
Read More 1413
Read More 1414
Read More 1415
Read More 1416
Read More 1417
Read More 1418
Read More 1419
Read More 1420
Read More 1421
Read More 1422
Read More 1423
Read More 1424
Read More 1425
Read More 1426
Read More 1427
Read More 1428
Read More 1429
Read More 1430
Read More 1431
Read More 1432
Read More 1433
Read More 1434
Read More 1435
Read More 1436
Read More 1437
Read More 1438
Read More 1439
Read More 1440
Read More 1441
Read More 1442
Read More 1443
Read More 1444
Read More 1445
Read More 1446
Read More 1447
Read More 1448
Read More 1449
Read More 1450
Read More 1451
Read More 1452
Read More 1453
Read More 1454
Read More 1455
Read More 1456
Read More 1457
Read More 1458
Read More 1459
Read More 1460
Read More 1461
Read More 1462
Read More 1463
Read More 1464
Read More 1465
Read More 1466
Read More 1467
Read More 1468
Read More 1469
Read More 1470
Read More 1471
Read More 1472
Read More 1473
Read More 1474
Read More 1475
Read More 1476
Read More 1477
Read More 1478
Read More 1479
Read More 1480
Read More 1481
Read More 1482
Read More 1483
Read More 1484
Read More 1485
Read More 1486
Read More 1487
Read More 1488
Read More 1489
Read More 1490
Read More 1491
Read More 1492
Read More 1493
Read More 1494
Read More 1495
Read More 1496
Read More 1497
Read More 1498
Read More 1499
Read More 1500