Security in Drupal: what can go wrong?
summary
Overview ties Drupal security to the OWASP Top Ten and focuses on two concrete problems: keeping components current and injection bugs. Release schedule is specific — core security updates on the third Wednesday, any Wednesday for contrib, and automated attacks followed Drupalgeddon within seven hours. The real patch changed array handling (array_keys → array_values) to stop user-supplied array keys enabling SQL injection. Recommended tooling and checks include composer updates, the Security Review module, Security Kit, Paranoia, and two‑factor auth.
AI-written summary · about
chapters (6)
- 0:00Introduction and speaker background
- 11:19OWASP Top 10 overview
- 12:22Vulnerable outdated components
- 28:42SQL injection vulnerabilities
- 36:55Conclusion and security resources
- 39:45Q&A on security coverage
related talks
38mSecurity in Drupal 8: Tips and Tricks
39mSecurity, Drupal 9, and Navigating the Changing Web Landscape
53mOWASP Top 10: What are them and how to prevent them
19mFrontend Security is a Thing
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities
02h 18mWeb application security (Part 2)
52mPractical Security in Web Applications