Skip to content
Newer
Older
100644 194 lines (166 sloc) 5.61 KB
3bf293f @andigutmans - Change from PHP5 -> PHP 5
andigutmans authored Feb 8, 2004
1 Input Filter Support in PHP 5
2 -----------------------------
7429c2d @rlerdorf Input Filter support. See README.input_filter for details.
rlerdorf authored Feb 19, 2003
3
4 XSS (Cross Site Scripting) hacks are becoming more and more prevalent,
5 and can be quite difficult to prevent. Whenever you accept user data
6 and somehow display this data back to users, you are likely vulnerable
7 to XSS hacks.
8
3bf293f @andigutmans - Change from PHP5 -> PHP 5
andigutmans authored Feb 8, 2004
9 The Input Filter support in PHP 5 is aimed at providing the framework
7429c2d @rlerdorf Input Filter support. See README.input_filter for details.
rlerdorf authored Feb 19, 2003
10 through which a company-wide or site-wide security policy can be
11 enforced. It is implemented as a SAPI hook and is called from the
12 treat_data and post handler functions. To implement your own security
13 policy you will need to write a standard PHP extension.
14
15 A simple implementation might look like the following. This stores the
16 original raw user data and adds a my_get_raw() function while the normal
17 $_POST, $_GET and $_COOKIE arrays are only populated with stripped
18 data. In this simple example all I am doing is calling strip_tags() on
19 the data. If register_globals is turned on, the default globals that
20 are created will be stripped ($foo) while a $RAW_foo is created with the
21 original user input.
22
23 ZEND_BEGIN_MODULE_GLOBALS(my_input_filter)
24 zval *post_array;
25 zval *get_array;
26 zval *cookie_array;
27 ZEND_END_MODULE_GLOBALS(my_input_filter)
28
29 #ifdef ZTS
30 #define IF_G(v) TSRMG(my_input_filter_globals_id, zend_my_input_filter_globals *, v)
31 #else
32 #define IF_G(v) (my_input_filter_globals.v)
33 #endif
34
35 ZEND_DECLARE_MODULE_GLOBALS(my_input_filter)
36
37 function_entry my_input_filter_functions[] = {
38 PHP_FE(my_get_raw, NULL)
39 {NULL, NULL, NULL}
40 };
41
42 zend_module_entry my_input_filter_module_entry = {
43 STANDARD_MODULE_HEADER,
44 "my_input_filter",
45 my_input_filter_functions,
46 PHP_MINIT(my_input_filter),
47 PHP_MSHUTDOWN(my_input_filter),
48 NULL,
49 PHP_RSHUTDOWN(my_input_filter),
50 PHP_MINFO(my_input_filter),
51 "0.1",
52 STANDARD_MODULE_PROPERTIES
53 };
54
55 PHP_MINIT_FUNCTION(my_input_filter)
56 {
57 ZEND_INIT_MODULE_GLOBALS(my_input_filter, php_my_input_filter_init_globals, NULL);
58
59 REGISTER_LONG_CONSTANT("POST", PARSE_POST, CONST_CS | CONST_PERSISTENT);
60 REGISTER_LONG_CONSTANT("GET", PARSE_GET, CONST_CS | CONST_PERSISTENT);
61 REGISTER_LONG_CONSTANT("COOKIE", PARSE_COOKIE, CONST_CS | CONST_PERSISTENT);
62
63 sapi_register_input_filter(my_sapi_input_filter);
64 return SUCCESS;
65 }
66
67 PHP_RSHUTDOWN_FUNCTION(my_input_filter)
68 {
69 if(IF_G(get_array)) {
70 zval_ptr_dtor(&IF_G(get_array));
71 IF_G(get_array) = NULL;
72 }
73 if(IF_G(post_array)) {
74 zval_ptr_dtor(&IF_G(post_array));
75 IF_G(post_array) = NULL;
76 }
77 if(IF_G(cookie_array)) {
78 zval_ptr_dtor(&IF_G(cookie_array));
79 IF_G(cookie_array) = NULL;
80 }
81 return SUCCESS;
82 }
83
84 PHP_MINFO_FUNCTION(my_input_filter)
85 {
86 php_info_print_table_start();
87 php_info_print_table_row( 2, "My Input Filter Support", "enabled" );
88 php_info_print_table_row( 2, "Revision", "$Revision$");
89 php_info_print_table_end();
90 }
91
350d755 - Update NEWS and README for input_filters
Derick Rethans authored Nov 29, 2003
92 /* The filter handler. If you return 1 from it, then PHP also registers the
93 * (modified) variable. Returning 0 prevents PHP from registering the variable;
94 * you can use this if your filter already registers the variable under a
95 * different name, or if you just don't want the variable registered at all. */
c73641a - And fix the README too.
Derick Rethans authored Nov 30, 2003
96 SAPI_INPUT_FILTER_FUNC(my_sapi_input_filter)
7429c2d @rlerdorf Input Filter support. See README.input_filter for details.
rlerdorf authored Feb 19, 2003
97 {
98 zval new_var;
99 zval *array_ptr = NULL;
100 char *raw_var;
101 int var_len;
102
d08a0e9 @rlerdorf An input filter might not simply strip stuff, it might also turn things
rlerdorf authored Feb 20, 2003
103 assert(*val != NULL);
7429c2d @rlerdorf Input Filter support. See README.input_filter for details.
rlerdorf authored Feb 19, 2003
104
105 switch(arg) {
106 case PARSE_GET:
107 if(!IF_G(get_array)) {
108 ALLOC_ZVAL(array_ptr);
109 array_init(array_ptr);
110 INIT_PZVAL(array_ptr);
111 }
112 IF_G(get_array) = array_ptr;
113 break;
114 case PARSE_POST:
115 if(!IF_G(post_array)) {
116 ALLOC_ZVAL(array_ptr);
117 array_init(array_ptr);
118 INIT_PZVAL(array_ptr);
119 }
120 IF_G(post_array) = array_ptr;
121 break;
122 case PARSE_COOKIE:
123 if(!IF_G(cookie_array)) {
124 ALLOC_ZVAL(array_ptr);
125 array_init(array_ptr);
126 INIT_PZVAL(array_ptr);
127 }
128 IF_G(cookie_array) = array_ptr;
129 break;
130 }
131 Z_STRLEN(new_var) = val_len;
d08a0e9 @rlerdorf An input filter might not simply strip stuff, it might also turn things
rlerdorf authored Feb 20, 2003
132 Z_STRVAL(new_var) = estrndup(*val, val_len);
7429c2d @rlerdorf Input Filter support. See README.input_filter for details.
rlerdorf authored Feb 19, 2003
133 Z_TYPE(new_var) = IS_STRING;
134
135 var_len = strlen(var);
136 raw_var = emalloc(var_len+5); /* RAW_ and a \0 */
137 strcpy(raw_var, "RAW_");
138 strlcat(raw_var,var,var_len+5);
139
140 php_register_variable_ex(raw_var, &new_var, array_ptr TSRMLS_DC);
141
d08a0e9 @rlerdorf An input filter might not simply strip stuff, it might also turn things
rlerdorf authored Feb 20, 2003
142 php_strip_tags(*val, val_len, NULL, NULL, 0);
7429c2d @rlerdorf Input Filter support. See README.input_filter for details.
rlerdorf authored Feb 19, 2003
143
750b033 - Fix sapi_input_filter patch. Returning 1 from the filter handler sh…
Derick Rethans authored Nov 29, 2003
144 *new_val_len = strlen(*val);
350d755 - Update NEWS and README for input_filters
Derick Rethans authored Nov 29, 2003
145 return 1;
7429c2d @rlerdorf Input Filter support. See README.input_filter for details.
rlerdorf authored Feb 19, 2003
146 }
147
148 PHP_FUNCTION(my_get_raw)
149 {
150 long arg;
151 char *var;
152 int var_len;
153 zval **tmp;
154 zval *array_ptr = NULL;
155 HashTable *hash_ptr;
156 char *raw_var;
157
476c9a3 Fixed zend_parse_parameters arguments...
Stefan Esser authored Jun 24, 2004
158 if(zend_parse_parameters(2 TSRMLS_CC, "ls", &arg, &var, &var_len) == FAILURE) {
7429c2d @rlerdorf Input Filter support. See README.input_filter for details.
rlerdorf authored Feb 19, 2003
159 return;
160 }
161
162 switch(arg) {
163 case PARSE_GET:
164 array_ptr = IF_G(get_array);
165 break;
166 case PARSE_POST:
167 array_ptr = IF_G(post_array);
168 break;
169 case PARSE_COOKIE:
170 array_ptr = IF_G(post_array);
171 break;
172 }
173
174 if(!array_ptr) RETURN_FALSE;
175
176 /*
177 * I'm changing the variable name here because when running with register_globals on,
178 * the variable will end up in the global symbol table
179 */
180 raw_var = emalloc(var_len+5); /* RAW_ and a \0 */
181 strcpy(raw_var, "RAW_");
182 strlcat(raw_var,var,var_len+5);
183 hash_ptr = HASH_OF(array_ptr);
184
185 if(zend_hash_find(hash_ptr, raw_var, var_len+5, (void **)&tmp) == SUCCESS) {
186 *return_value = **tmp;
187 zval_copy_ctor(return_value);
188 } else {
189 RETVAL_FALSE;
190 }
191 efree(raw_var);
192 }
193
Something went wrong with that request. Please try again.