Versions Compared

Old Version 3

changes.mady.by.user Sharif Magembe

Saved on

compared with

New Version 4

changes.mady.by.user Grace Potma

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Primary mentor

Isaac Sears

Backup mentor

Sharif Magembe

Assigned to

N/A

Abstract

Late last year, OpenMRS began collaborating with researchers from North Carolina State University (NCSU) to better secure the OpenMRS Reference Application. NCSU researchers, using cutting-edge security assessment techniques, have identified almost 300 distinct security issues. Many of those issues are relatively low-complexity, requiring one-line patches. This is a great opportunity for students who are interested in software security to get first-hand experience in the field.

Project Champions

Objectives

  1. (First priority) Patch up to 50 XSS vulnerabilities
  2. (Second priority) Implement up to 25 authorization checks where they are lacking
  3. (Third priority) Implement safe exception handling for up to 10 HTTP 500 errors

Extra Credits

  1. Take on responsibility for patching more complex security issues

Skills Required

  1. Javascript, HTML
  2. Java

Skills Recommended

  1. Experience with .jsp and/or .gsp frontend templating languages
  2. Basic knowledge of common web application security vulnerabilities

Examples to Look Through While Preparing Your Proposal

1) Understand XSS vulnerabilities

2) Review some recent fix examples

For security reasons we can't publicly release the full NCSU report; however, you can check out these PRs for recent examples of the kinds of bugs that are being patched (and the kind of work the patches in this GSOC project entail):

Once you are accepted into the project, you will be ...

A successful proposal could include...