Secure coding 2026 : guide par langage (Python, JS, Java, Go)

# Python : validation Pydantic v2 (recommandé 2026)
from pydantic import BaseModel, EmailStr, constr, conint
 
class UserCreate(BaseModel):
    email: EmailStr  # Validation email RFC 5322
    age: conint(ge=18, le=120)  # int contraint 18-120
    username: constr(pattern=r'^[a-zA-Z0-9_]{3,32}$')  # regex strict
    password: constr(min_length=12)  # password min 12 caractères
 
# Anti-pattern : confiance dans l'input
# user = request.json  # ❌ pas de validation

// TypeScript : validation Zod (équivalent Pydantic)
import { z } from "zod";
 
const UserCreateSchema = z.object({
  email: z.string().email(),
  age: z.number().int().min(18).max(120),
  username: z.string().regex(/^[a-zA-Z0-9_]{3,32}$/),
  password: z.string().min(12),
});
 
const validated = UserCreateSchema.parse(req.body);  // throw si invalide

// JavaScript : utiliser DOMPurify pour HTML, encodeURIComponent pour URL
import DOMPurify from 'dompurify';
 
// Contexte HTML : DOMPurify avec policy stricte
const safeHtml = DOMPurify.sanitize(userContent, {
  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
  ALLOWED_ATTR: ['href'],
});
 
// Contexte URL : encodeURIComponent
const safeUrl = `/search?q=${encodeURIComponent(userQuery)}`;
 
// Contexte attribut HTML : escape attribute
const safeAttr = userInput.replace(/[<>"'&]/g, (char) =>
  ({ '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#x27;', '&': '&amp;' })[char]
);

# Python : utiliser argon2-cffi (recommandé OWASP 2026)
from argon2 import PasswordHasher
 
ph = PasswordHasher(
    time_cost=2,        # 2 itérations
    memory_cost=65536,  # 64 MB
    parallelism=4,      # 4 threads
)
 
# Hash password
hashed = ph.hash(plaintext_password)
 
# Verify password
try:
    ph.verify(hashed, user_input_password)
    # Password correct
except VerifyMismatchError:
    # Password incorrect
    pass

// JavaScript : utiliser argon2 ou bcrypt (Node.js)
const argon2 = require('argon2');
 
// Hash password
const hash = await argon2.hash(password, {
  type: argon2.argon2id,
  memoryCost: 65536,
  timeCost: 2,
  parallelism: 4,
});
 
// Verify password
const valid = await argon2.verify(hash, password);

// Exemple : middleware Express avec RBAC + ABAC
import { Request, Response, NextFunction } from 'express';
 
interface AuthRequest extends Request {
  user: { id: string; role: string; tenantId: string };
}
 
// Niveau 1 : RBAC (rôle requis)
function requireRole(role: string) {
  return (req: AuthRequest, res: Response, next: NextFunction) => {
    if (req.user.role !== role) {
      return res.status(403).json({ error: 'Forbidden role' });
    }
    next();
  };
}
 
// Niveau 2 : ABAC (ownership / tenant check)
async function requireOwnership(req: AuthRequest, res: Response, next: NextFunction) {
  const resource = await db.resource.findUnique({ where: { id: req.params.id } });
  if (!resource || resource.tenantId !== req.user.tenantId) {
    return res.status(404).json({ error: 'Not found' });  // 404 plutôt que 403 pour pas leak existence
  }
  next();
}
 
// Usage : combinaison des 2 middlewares
app.delete('/api/resources/:id',
  requireRole('admin'),       // RBAC
  requireOwnership,           // ABAC
  deleteResourceHandler
);

# ❌ ANTI-PATTERN : SQL injection via string concat
import sqlite3
 
conn = sqlite3.connect('app.db')
cur = conn.cursor()
user_id = request.args.get('id')
cur.execute(f"SELECT * FROM users WHERE id = {user_id}")  # SQL injection!
 
# ✅ PATTERN SÉCURISÉ : prepared statements
cur.execute("SELECT * FROM users WHERE id = ?", (user_id,))
 
# ❌ ANTI-PATTERN : command injection via subprocess
import subprocess
 
filename = request.args.get('file')
subprocess.run(f"cat {filename}", shell=True)  # Command injection!
 
# ✅ PATTERN SÉCURISÉ : args list, jamais shell=True
subprocess.run(["cat", filename], shell=False, check=True)
 
# ❌ ANTI-PATTERN : pickle deserialization (CVE-prone)
import pickle
 
data = pickle.loads(user_provided_bytes)  # RCE possible
 
# ✅ PATTERN SÉCURISÉ : utiliser JSON ou format strict signed
import json
data = json.loads(user_provided_bytes.decode('utf-8'))

// ❌ ANTI-PATTERN : prototype pollution
const userInput = JSON.parse(req.body);
const merged = Object.assign({}, defaults, userInput);  // {"__proto__": {"isAdmin": true}}
 
// ✅ PATTERN SÉCURISÉ : utiliser Object.create(null) ou Map
const merged = Object.assign(Object.create(null), defaults, userInput);
// OU utiliser une lib safe comme lodash mergeWith avec customizer
 
// ❌ ANTI-PATTERN : XSS DOM via innerHTML
element.innerHTML = userMessage;
 
// ✅ PATTERN SÉCURISÉ : textContent OU DOMPurify
element.textContent = userMessage;  // Pas d'interprétation HTML
// OU
import DOMPurify from 'dompurify';
element.innerHTML = DOMPurify.sanitize(userMessage);
 
// ❌ ANTI-PATTERN : SSRF via axios sans allowlist
const response = await axios.get(req.body.url);
 
// ✅ PATTERN SÉCURISÉ : allowlist + IP filtering
const ALLOWED_HOSTS = ['api.partner1.com', 'api.partner2.com'];
const url = new URL(req.body.url);
if (!ALLOWED_HOSTS.includes(url.hostname)) {
  throw new Error('Domain not allowed');
}
const response = await axios.get(url.toString(), { timeout: 5000 });

// ❌ ANTI-PATTERN : insecure deserialization (Log4Shell-like)
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
Object obj = ois.readObject();  // RCE possible !
 
// ✅ PATTERN SÉCURISÉ : utiliser JSON (Jackson) avec validation
ObjectMapper mapper = new ObjectMapper();
mapper.disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
UserDto user = mapper.readValue(jsonString, UserDto.class);
 
// ❌ ANTI-PATTERN : XXE (XML External Entity)
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
Document doc = db.parse(input);  // XXE possible !
 
// ✅ PATTERN SÉCURISÉ : disable external entities
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);

// ❌ ANTI-PATTERN : path traversal
import "path/filepath"
 
func readFile(filename string) ([]byte, error) {
    return os.ReadFile(filepath.Join("/data", filename))
    // Si filename = "../../../etc/passwd" → traversal !
}
 
// ✅ PATTERN SÉCURISÉ : validation stricte + chroot
func readFile(filename string) ([]byte, error) {
    base := "/data"
    full := filepath.Join(base, filename)
    abs, err := filepath.Abs(full)
    if err != nil {
        return nil, err
    }
    if !strings.HasPrefix(abs, base+string(os.PathSeparator)) {
        return nil, errors.New("path traversal detected")
    }
    return os.ReadFile(abs)
}
 
// ❌ ANTI-PATTERN : TLS verification désactivé
client := &http.Client{
    Transport: &http.Transport{
        TLSClientConfig: &tls.Config{InsecureSkipVerify: true},  // ❌
    },
}
 
// ✅ PATTERN SÉCURISÉ : TLS verification activée + cert pinning si critical
client := &http.Client{
    Transport: &http.Transport{
        TLSClientConfig: &tls.Config{
            MinVersion: tls.VersionTLS12,  // TLS 1.2+ obligatoire
        },
    },
    Timeout: 5 * time.Second,
}

// ❌ ANTI-PATTERN : SQL injection via string interpolation
var userId = Request.Query["id"];
var sql = $"SELECT * FROM Users WHERE Id = {userId}";  // SQL injection !
var users = db.Database.ExecuteSqlRaw(sql);
 
// ✅ PATTERN SÉCURISÉ : parameterized query
var users = db.Users
    .FromSqlInterpolated($"SELECT * FROM Users WHERE Id = {userId}")  // EF Core sécurise auto
    .ToList();
 
// ❌ ANTI-PATTERN : XSS via Razor @Html.Raw
@Html.Raw(Model.UserMessage)  // ❌ Bypass HTML encoding
 
// ✅ PATTERN SÉCURISÉ : default Razor encoding
@Model.UserMessage  // ✅ Auto-encoded

# Extensions VS Code à installer
code --install-extension SonarSource.sonarlint-vscode
code --install-extension snyk-security.snyk-vulnerability-scanner
code --install-extension semgrep.semgrep

# Installation pre-commit framework
pip install pre-commit
 
# .pre-commit-config.yaml
cat > .pre-commit-config.yaml <<'EOF'
repos:
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.5.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
 
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.0
    hooks:
      - id: gitleaks
 
  - repo: https://github.com/returntocorp/semgrep
    rev: v1.93.0
    hooks:
      - id: semgrep
        args: ['--config=p/owasp-top-ten', '--error']
EOF
 
pre-commit install
detect-secrets scan > .secrets.baseline

# .github/workflows/secure-coding.yml
name: Secure Coding Pipeline
 
on: [pull_request]
 
jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Semgrep OWASP Top 10
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/owasp-top-ten p/secrets
 
      - name: SonarCloud scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
      - name: Snyk Code SAST
        uses: snyk/actions/python@master
        with:
          command: code test
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
      - name: gosec (if Go project)
        if: hashFiles('go.mod') != ''
        uses: securego/gosec@master
        with:
          args: ./...