Re: Plug-ins Support

The only data availiable at that point is data that is already been 
cleaned. The $_GET, $_POST, etc are all blown away. Therefore plug-in 
developers cannot bypass the applications cleaning function.

A quick and dirty example (forgive ugliness, please):

<?
function clean_input($pa_bypass = false) {
    $a_cleaning = array();
    $a_bypass = ( $pa_bypass === false ? array() : $pa_bypass );
    foreach ( $_POST as $key => $value ) {
        $a_cleaning[$key] = ( !in_array($key, $a_bypass) ? 
htmlspecialchars(strip_tags(trim($value), ENT_QUOTES)) : $value );
    }
    foreach ( $_GET as $key => $value ) {
        $a_cleaning[$key] = ( !in_array($key, $a_bypass) ? 
htmlspecialchars(strip_tags(trim($value), ENT_QUOTES)) : $value );
    }
    unset($_POST, $_GET, $_REQUEST);
    return $a_cleaning;
}

$a_cleaned = array();
$a_cleaned = clean_input();
?>
<form name="input_testing" id="input_test" 
action="superglobals.php?this=that&number=1" method="post" 
enctype="multipart/form-data" target="_self">
<input type="text" name="textbox" id="test_textbox" size="20" 
maxlength="100">
<input type="text" name="textbox_2" id="test_textbox_2" size="20" 
maxlength="100">
<input type="text" name="textbox_3" id="test_textbox_3" size="20" 
maxlength="100">
<input type="text" name="textbox_4" id="test_textbox_4" size="20" 
maxlength="100">
<input type="submit" name="test_submit" id="submit_input_testing" 
value="Submit">
</form>
<br><br>
<strong>Input now in the cleaned array</strong>:
<br>
<?
print_r($a_cleaned);
?>
<br><br>
<strong>And now print the GLOBAL array</strong>:
<br>
<?
print_r($GLOBALS);
?>

You will see that the only way to access data (let's say 'textbox' for 
example) in the application is to use the application's $a_cleaned array. 

echo $a_cleaned['textbox'];     // whatever data you put in and submitted
echo $_POST['textbox'];         // not set
print_r($GLOBALS['_POST']);     // not set
print_r($GLOBALS['a_cleaned']); // prints the $a_cleaned array

Of course, we don't care that the $a_cleaned array is in $GLOBALS, because 
it has already been cleaned. However, the globals we choose to unset are 
gone and not availiable to the plug-in developers. Therefore, the 
application retains authority on all input submitted by plug-ins even 
before the plug-in can use the input.


 On Mon, 15 Oct 2007, John Reese wrote:
> You are not understanding my point.  If you reference the variable 
> $GLOBALS in a PHP script, you are accessing an array of *every* variable 
> allocated in the PHP interpreter, *including a recursive reference* to 
> $GLOBALS.

                *~*
---------------(O.o)--
. Van Tate Jr.
. Software Security && Production Release Manager
. van AT [AT=@] payquik.com

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/