security-essentials

Security Essentials

RULES — Follow these with no exceptions

1. Never use String.to_atom/1 on user input — atoms are never garbage collected; user-controlled atoms exhaust the atom table and crash the BEAM VM. String.to_existing_atom/1 avoids that risk but still raises ArgumentError on unknown input (unhandled 500) — whitelist with a case instead of either
2. Never interpolate strings into fragment() or SQL.query() — always use ? parameters for fragments and $1 for raw SQL
3. Never redirect to user-controlled URLs — validate against a whitelist or use verified routes (~p"...")
4. Avoid raw/1 in templates — Phoenix auto-escapes for a reason; if HTML is required, sanitize first with a library like HtmlSanitizeEx
5. Never log sensitive data — passwords, tokens, secrets, API keys, and credentials must never appear in Logger calls
6. Use Plug.Crypto.secure_compare/2 for token comparison — never ==, which enables timing attacks
7. Run dependency audits after changes — mix hex.audit checks for retired/deprecated packages (checksum verification against Hex is already automatic via mix.lock); mix deps.audit (requires adding {:mix_audit, "~> 2.1", only: [:dev, :test], runtime: false}) checks for known CVEs; mix sobelow does static security analysis of your code

---

Atom Table Exhaustion

The BEAM atom table has a fixed limit (default ~1M atoms) and is never garbage collected. If an attacker can create arbitrary atoms, they crash the entire VM.

Bad:

# User controls the atom — creates atoms forever: atom table exhaustion, VM crash
role = String.to_atom(params["role"])

# Never creates atoms, but raises ArgumentError on unknown input (unhandled 500)
status = String.to_existing_atom(params["status"])

Good:

# Whitelist approach — only known values become atoms
case params["role"] do
  "admin" -> :admin
  "user" -> :user
  "moderator" -> :moderator
  _ -> {:error, :invalid_role}
end

# Or keep as strings throughout
def authorize(%{"role" => "admin"}), do: :ok
def authorize(%{"role" => _}), do: {:error, :unauthorized}