How much Out of Box Broadleaf is secured?

Question

I am evaluating Broadleaf Commerce.
Currently I am having one concern. If I install Out-Of-Box Broadleaf Commerce how secure is it? What are existing vulnerabilities that I need to see while using out of box?

I went though documentation. It was mentioned that, SQL Injection and XSS has been taken care.But not sure as to what extent that has been taken care of.

I am new to eCommerce and security so am unable to evaluate this parameter.

Answer 1

From the offical Broadleaf forum:

Broadleaf Commerce uses an extendible ORM strategy based on JPA (and specifically Hibernate behind the scenes). If you drill down even further, we are entirely using prepared statements and we do not dynamically build queries at all using user input. This deals with the SQL injection issue.

As for XSS, we utilize Spring MVC as our de-facto engine for the presentation layer and even provide some out-of-the-box controllers to speed development in this area. Spring MVC has great support for protection against XSS through html escape sequences via simple configuration. This blog talks about it a bit more: http://sanjaysinghloha.blogspot.com/200 ... ng_05.html. Having said that, as an e-commerce framework, Broadleaf Commerce does not force you to use Spring MVC to create a site. Any modern Java-based MVC framework should work fine with Broadleaf Commerce, but care should be taken with any MVC framework choice to account for XSS protection.

One of our partners has built their entire e-commerce site on Broadleaf Commerce using Spring MVC and Spring Security and has utilized S3 Security (http://www.s3security.com) to perform their extensive penetration testing as part of their successful PCI certification. S3 uses several tools, one of which is Retina Scanner.

No vulnerabilities have been discovered so far.

IMHO as a penetration tester view, it seems pretty safe and developed with security in mind but still this doesn't mean it's invulnerable. By implementing a WAF such as mod_security and being aware of the updates you will be good to go.