CRV2 RevCodePersistentAntiPatternPHP - Revision history

Johanna Curiel at 19:38, 3 May 2014

2014-05-03T19:38:58Z

Johanna Curiel at 19:37, 3 May 2014

2014-05-03T19:37:58Z

Johanna Curiel at 19:36, 3 May 2014

2014-05-03T19:36:44Z

Johanna Curiel at 19:35, 3 May 2014

2014-05-03T19:35:43Z

Show changes

Johanna Curiel at 19:34, 3 May 2014

2014-05-03T19:34:11Z

Johanna Curiel at 19:32, 3 May 2014

2014-05-03T19:32:00Z

Show changes

Abbas Naderi: Persistent XSS mitigation

2013-10-18T19:26:57Z

Persistent XSS mitigation

New page

It is pretty easy to remove all persistent XSS attacks from PHP, just remove all instances of output functions (such as echo and print) with their safe counterparts from OWASP PHP Security Core Library, and then whenever you need HTML elements to be outputted, used the appropriate functions or PHP tags. There's a scanner in PHP Security Project that scans for this and can replace it effectively as well.

@@ Line 2: / Line 2: @@
 ==Scanner PHP==
-As mentioned earlier, you can download the Scanner PHP using the PHPSERC framework at https://www.owasp.org/index.php/OWASP_PHP_Security_Project
+As mentioned earlier, you can download the Scanner PHP using the PHPSEC framework at https://www.owasp.org/index.php/OWASP_PHP_Security_Project
    /**
@@ Line 9: / Line 9: @@
    */
    public static $blacklist = array("T_ECHO"=>"echo", "T_PRINT"=>"print","printf","vprintf");

← Older revision		Revision as of 19:37, 3 May 2014
Line 9:		Line 9:
	*/		*/
	public static $blacklist = array("T_ECHO"=>"echo", "T_PRINT"=>"print","printf","vprintf");		public static $blacklist = array("T_ECHO"=>"echo", "T_PRINT"=>"print","printf","vprintf");
		+
		+	/**
		+	* Function to start a scan in a directory.
		+	* @return Array
		+	* @throws DirectoryNotFoundException
		+	*/
		+	public static function scanDir($parentDirectory)
		+	{
		+	$occurences = array(array());
		+
		+	//if the directory/file does not exists, then throw and error.
		+	if ( !file_exists( $parentDirectory ) )
		+	{
		+	throw new DirectoryORFileNotFoundException("ERROR: Directory not found!");
		+	}
		+
		+
		+	//get the list of all the files inside this directory.
		+	$allFiles = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($parentDirectory));
		+
		+	$fileList = array();
		+
		+	//remove (.), (..) and directories from the list of all files so that only files are left.
		+	while($allFiles->valid())
		+	{
		+	if (!$allFiles->isDot()) //remove present director[.] and parent directory[..]
		+	{
		+	if (!is_dir($allFiles->key()))
		+	{
		+	array_push($fileList, $allFiles->key());
		+	}
		+	}
		+
		+	$allFiles->next();
		+	}
		+
		+	$i = 0;
		+	foreach ($fileList as $file) //add errors found to the results.
		+	{
		+	if (pathinfo($file, PATHINFO_EXTENSION)!="php") continue;
		+	$occurences[$i]['file'] = realpath($file);
		+	$occurences[$i]['result'] = Scanner::scanFile($file);
		+
		+	$i++;
		+	}
		+
		+	return $occurences;
		+	}

@@ Line 4: / Line 4: @@
 As mentioned earlier, you can download the Scanner PHP using the PHPSERC framework at https://www.owasp.org/index.php/OWASP_PHP_Security_Project
-         /**
+  /**
-	 * Array to hold all the words that are considered unsafe.
+  * Array to hold all the words that are considered unsafe.
-	 * @var Array
+  * @var Array
-	 */
+  */
-	public static $blacklist = array("T_ECHO"=>"echo", "T_PRINT"=>"print","printf","vprintf");
+  public static $blacklist = array("T_ECHO"=>"echo", "T_PRINT"=>"print","printf","vprintf");

@@ Line 2: / Line 2: @@
 ==Scanner PHP==
-The code regarding control to scan unsafe words follows
+As mentioned earlier, you can download the Scanner PHP using the PHPSERC framework at https://www.owasp.org/index.php/OWASP_PHP_Security_Project
-        /**
+     /**
 	 * Function to start a scan in a directory.
 	 * @return Array
@@ Line 225: / Line 220: @@
+		}
+	}
-−
+  }
-?>
+  ?>