OWASP Cheat Sheet Series

import bcrypt from 'bcrypt';

// Almacenamiento (registro)
const SALT_ROUNDS = 12; // work factor recomendado para 2025
const hashedPassword = await bcrypt.hash(plainPassword, SALT_ROUNDS);
// → almacenar hashedPassword en BD, nunca plainPassword

// Verificación (login)
const isValid = await bcrypt.compare(inputPassword, storedHash);
// → bcrypt ya maneja timing-safe comparison internamente

// ❌ NUNCA usar:
// MD5, SHA1, SHA256 directos (sin salt, sin work factor → crackeable con GPU)
// crypto.createHash('md5').update(pass).digest('hex')

// HTML Context — escapar entidades HTML
function escapeHtml(str: string): string {
  return str
    .replace(/&/g, '&')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#x27;');
}

// DOM Context — usar DOMPurify para HTML enriquecido
import DOMPurify from 'dompurify';
const cleanHtml = DOMPurify.sanitize(userInput, {
  ALLOWED_TAGS: ['b', 'i', 'em', 'strong'],
  ALLOWED_ATTR: []
});

// JavaScript Context — nunca interpolar directamente
// Ejemplo: const js = JSON.stringify({ user: userName });
// ✅ Usar JSON.stringify() para datos en scripts
const safeData = JSON.stringify({ user: userName });
const js = 'var user = ' + safeData + ';';

// URL Context — encodeURIComponent para parámetros
const url = '/search?q=' + encodeURIComponent(userQuery);

import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';

const ALGORITHM = 'aes-256-gcm'; // ✅ modo autenticado

function encrypt(plaintext: string, key: Buffer): { iv: string; tag: string; data: string } {
  const iv = randomBytes(12); // 96 bits para GCM
  const cipher = createCipheriv(ALGORITHM, key, iv);
  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
  const tag = cipher.getAuthTag(); // authentication tag de GCM
  return {
    iv: iv.toString('hex'),
    tag: tag.toString('hex'),
    data: encrypted.toString('hex')
  };
}

function decrypt(encrypted: { iv: string; tag: string; data: string }, key: Buffer): string {
  const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(encrypted.iv, 'hex'));
  decipher.setAuthTag(Buffer.from(encrypted.tag, 'hex'));
  return Buffer.concat([
    decipher.update(Buffer.from(encrypted.data, 'hex')),
    decipher.final()
  ]).toString('utf8');
}

// next.config.ts — cabeceras de seguridad recomendadas por OWASP
const securityHeaders = [
  {
    key: 'X-DNS-Prefetch-Control',
    value: 'on'
  },
  {
    key: 'Strict-Transport-Security',
    value: 'max-age=63072000; includeSubDomains; preload'  // HSTS 2 años
  },
  {
    key: 'X-Frame-Options',
    value: 'SAMEORIGIN'  // Clickjacking protection
  },
  {
    key: 'X-Content-Type-Options',
    value: 'nosniff'  // MIME sniffing protection
  },
  {
    key: 'Referrer-Policy',
    value: 'origin-when-cross-origin'
  },
  {
    key: 'Content-Security-Policy',
    value: "default-src 'self'; script-src 'self' 'nonce-{nonce}'; ..."
  },
  {
    key: 'Permissions-Policy',
    value: 'camera=(), microphone=(), geolocation=()'
  }
];

# ❌ Imagen insegura
FROM node:latest
COPY . /app
RUN npm install
CMD ["node", "server.js"]

# ✅ Imagen segura siguiendo Docker Security CS
FROM node:22-alpine AS builder   # imagen mínima, no 'latest'
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production     # solo dependencias de producción

FROM node:22-alpine AS runner
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY --chown=appuser:appgroup . .
USER appuser                     # no-root
EXPOSE 3000
CMD ["node", "server.js"]