Proving once and for all that if you give someone a hand grenade, they'll go marching around with the pin out on the street.
Exec($_GET
11–20 of 131 posts
Re: Exec($_GET
#12"We've found 99,841 code results"
Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but I'm chronically lazy.
Re: Exec($_GET
#13As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work the same...)
Re: Exec($_GET
#14Directly passing user data to the command line is highly dangerous.It allows an attacker to execute arbitrary commands on the command line [0].
escapehellarg [1] has to be used to Escape a string to be used as a shell argument
[0] http://gcattani.co.vu/2013/03/a-tale-of-a-php-shell/ [1] http://php.net/manual/en/function.escapeshellarg.php
Re: Exec($_GET
#15As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work…
Re: Exec($_GET
#16Something like this might make a great feature for github — exploit code review warnings/alerts.
It would actually be a nice to build an optional warning feature into `git` itself. You could download some known common issues and the script would generate warnings if you checked in corresponding code. E.g.
git add id_rsa
WARNING: You may have just staged a private key.
echo '{"password": "mypassword"}' > config.json
git add config.json
WARNING: You may have just staged a password.Re: Exec($_GET
#17As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work…
Re: Exec($_GET
#18As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work…
https://en.wikipedia.org/wiki/Taint_checking
Of note is that Perl had this since at least 1998. See http://gunther.web66.com/FAQS/taintmode.html
But of course we just laugh about Perl and pat ourself on our backs with our safe new languages because we clearly know much more than those anachronistic neckbeards.
Re: Exec($_GET
#19As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work…
perl and ruby have "taint" which is similar to what you describe.
And yes, this can be encoded in the type system and you can also make it so the sanitization is context dependent, i.e. http://www.comp.nus.edu.sg/~prateeks/papers/csas-ccs11.pdf
Re: Exec($_GET
#20Meet his brother https://github.com/search?q=eval%28%24_GET&type=Code&ref=sea... (eval($_GET