Mazuva mashoma apfuura kunetseka kwakaburitswa mune inozivikanwa online kosi chikuva Coursera uye nderekuti dambudziko raaive naro raive muAPI, saka Zvinotendwa kuti zvinokwanisika kuti vapambi vangadai vakashungurudza kusagadzikana "BOLA" kuti unzwisise zvavanofarira kosi yevashandisi, pamwe nekukanganisa sarudzo yemushandisi.
Pamusoro pezvo zvinofungidzirwawo kuti kusagadzikana kuchangobva kuburitswa kwaigona kuve kwakaburitsa data remushandisi risati ragadziriswa. Izvi zvikanganiso zvakawanikwa nevatsvakurudzi kubva kambani yekuongorora yekuchengetedza checkmarx uye yakaburitswa muvhiki rapfuura.
Kudzvinyirirwa zvine chekuita nemhando dzakasiyana dzeCoursera application programming inopindirana uye vaongorori vakasarudza kuongorora kuchengetedzeka kweC Coursera nekuda kwekuwedzera kwayo mukurumbira kuburikidza nekuchinjira kubasa nekudzidza pamhepo nekuda kwechirwere cheCOVID-19.
Kune avo vasingazive nezveCoursera, iwe unofanirwa kuziva kuti iyi ikambani ine makumi masere nemaviri evashandisi uye inoshanda nemakambani anopfuura mazana maviri nemayunivhesiti. Kudyidzana kunozivikanwa kunosanganisira University of Illinois, Duke University, Google, University of Michigan, International Business Machines, Imperial College London, Stanford University, uye University of Pennsylvania.
Nyaya dzakasiyana dzeAPI dzakawanikwa kusanganisira mushandisi / account enumeration kuburikidza ne password reset chinhu, kushomeka kwezviwanikwa kudzikamisa zvese iyo GraphQL API uye REST, uye isiriyo GraphQL kumisikidzwa. Kunyanya, chakaputswa chinhu chikamu chebvumirano mvumo nyaya iri pamusoro pechinyorwa.
Kana tichifambidzana neiyo Coursera webhu kunyorera sevashandisi venguva dzose (vadzidzi), takaona kuti nguva dzichangopfuura dzinoonekwa makosi dzakaratidzirwa mushandisi yekushandisa. Kumiririra urwu ruzivo, tinoona akawanda API eGET zvikumbiro kunzvimbo imwechete yekupedzisira: /api/userPreferences.v1/ [USER_ID-lex.europa.eu~[PREFERENCE_TYPE}.
Iyo BOLA API kudzvinyirirwa inotsanangurwa seyakakanganiswa mushandisi zvido. Kutora mukana wekushupika, kunyange vashandisi vasingazivikanwe vakakwanisa kutora zvavanofarira, asi zvakare nekuzvichinja. Zvimwe zvekufarira, senge dzichangobva kutariswa makosi uye zvitupa, zvakare zvinesefa mamwe metadata. BOLA zvikanganiso mumaAPIs zvinogona kufumura magumo inobata zvitupa, izvo zvinogona kuvhura musuwo kurwisa kwakawanda.
"Kunetseka uku kungadai kwakashandiswa zvisina kufanira kuti vanzwisise zvido zvevashandisi zvakajairika pamwero wakakura, asi nekurwadzisa sarudzo dzevashandisi neimwe nzira, sekumanikidza kwechiitiko chavo chazvino chakakanganisa zvirimo zvakaratidzwa papeji rekutanga Coursera kune chakatarwa. mushandisi, ”vatsvakurudzi vanotsanangura.
"Nehurombo, matambudziko emvumo akajairika kumaAPI," vanodaro vatsvakurudzi. "Zvakakosha kuisa mukana wekupinda mukubvumidzwa kwekuwana mukana mune chimwe chinhu, chakayedzwa zvakanaka, chichiedzwa nekuenderera mberi nekuchengetedzwa. "Nzvimbo dzekupedzisira dzeAPI, kana shanduko kune dziripo, dzinofanirwa kuongororwa zvakaringana maererano nezvinodiwa nekuchengetedza.
Vatsvaguriri vakaona kuti matambudziko emvumo akajairika nemaAPI uye kuti nekudaro zvakakosha kuisa pakati peanodzora ekuwana mvumo. Kuita izvi kunofanirwa kuve kuburikidza neyakafanana, yakayedzwa-uye inoramba ichienderera chikamu.
Vakawana kusagadzikana vakaendeswa kuboka rekuchengetedza raCaresera musi waGumiguru 5. Chivimbiso chekuti kambani yakagamuchira rondedzero uye yaishanda pairi yakauya Gumiguru 26, uye Coursera akazonyora Cherkmarx achiti vagadzirisa nyaya idzi muna Zvita 18 kusvika Ndira 2 uye Coursera akabva atumira gwaro redzidzo nyowani nedambudziko nyowani. Pakupedzisira, Musi waMay 24, Coursera akasimbisa kuti nyaya dzese dzakagadziriswa.
Kunyangwe paine nguva yakati rebei kubva pakuburitswa nekugadziriswa, vaongorori vakati timu yekuchengetedza yeC Coursera yaifadza kushanda nayo.
"Hunyanzvi hwavo pamwe nekushandira pamwe, pamwe nekukurumidza kubata kwavanofungidzira, ndizvo zvatiri kutarisira kana tichiita nemakambani esoftware," vakapedzisa.
mabviro: https://www.checkmarx.com