cheatsheets | A collection of cheatsheets | Learning library

Scenario: As an Administrator I need to invalidate a user's session (log them out) after I update the user's password. This is in accordance with best practices as per https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#Renew_the_Session_ID_After_Any_Privilege_Level_Change

I am using Devise and I saw here https://stackoverflow.com/a/45756884/664675 there is a config to log the user out: config.sign_in_after_reset_password = false

However, I have enabled this config in my devise.rb but the user remains logged in. Not sure why that is?

I am also using Redis as the session_store

I'm noticing some odd behavior with R regex quantifiers written as either {min, max} (as recommend in the stringr cheatsheet) vs. as {min - max}, when using the pointblank package. I expect the regexes to work with {min, max} and fail with {min - max}. However, in the two examples below, one works with {min, max} and one works with {min - max}.

Example 1 works as expected: pattern_comma works and pattern_dash does not. But example 2 works unexpectedly: doi_pattern_comma does not work and doi_pattern_dash does work.

Any suggestions about this regex? Or might this be a bug in pointblank (in which case I can open an issue there)?

Thank you, SO community!

I am looking for a smooth way to change a ggplot2 output to grey level.

Here an example:

I'm building an iframe, not with innerHTML, but with createElement.. I have two untrusted strings that are used:

Nuxt SSR app using FirebaseUI to handle auth flows. Logging in and out works perfectly. When I add Middleware to check auth state and redirect if not logged in I get this error:

Error: Redirected when going from "/list-cheatsheets" to "/login" via a navigation guard.

middleware/auth.js

As per OWASP sesssion's must have an absolute timeout which defines the maximum amount of time a session can be active. I know how to set the max inactivity timeout for a spring session using server.servlet.session.timeout however I am not sure how to set the absolute timeout for the session. I guess I could set the Max-Age attribute for the Cookie which would potentially serve as an absolute timeout, however I was wondering if the absolute timeout could be somehow set on the server side session?

I'm familiar with using templates in NodeJS like EJS to escape data for an HTML context.

However what would be the recommended way to safely output from an API? Given the intended usage is not known, it couldn't be escaped using HTML encoding.

Since I'm currently basically just doing res.json({}) for the output.

I'm thinking while some fields of incoming data can be validated (like 'email'), other fields that are more vague (like 'description') could contain any of the characters someone might use for XSS. Like < and ;. The options on OWASP seem limited https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html Like this, but it was last updated 7 years ago https://github.com/ESAPI/node-esapi

Is it up to the recipient to handle? So if someone sends "alert(0);" as their description, I allow it through, as that is a valid JSON {"description":"alert(0);"}

I have an unordered list of list items containing elements for labels and values that are dynamically generated. I am trying to validate that the list contains a specific label with a specific value.

I am attempting to write an xpath that will allow me to find the parent element that contains the defined label and value with protractor's element(by.xpath). Given a list, I need to be able to find any single li by the combination of two descendants of specific attributes. For example, a li element that contains any descendent with class=label and text=Color AND any descendent with text=Blue.

I'm looking at an R script that I found online related to fantasy football predictions, and the code is a little outdated so I'm trying to make it work for this season of the NFL. I am somewhat familiar with R but I don't know anything about HTML or PHP, and in order to gather the player's data I need the table from this URL: http://www.fantasypros.com/nfl/rankings/consensus-cheatsheets.php

This is the line of code that they used to extract the table, but it doesn't seem to work anymore.

experts <- data.table(readHTMLTable("http://www.fantasypros.com/nfl/rankings/consensus-cheatsheets.php", stringsAsFactors = FALSE)$data)

It simple says Error: failed to load external entity "http://www.fantasypros.com/nfl/rankings/consensus-cheatsheets.php"

I've looked up different ways to pull tables out of a website, but they are all unique to that particular table. Any way I could get all of this data into a data frame in R?