Annotation of embedaddon/php/README.input_filter, revision 1.1
1.1 ! misho 1: Input Filter Support in PHP 5
! 2: -----------------------------
! 3:
! 4: XSS (Cross Site Scripting) hacks are becoming more and more prevalent,
! 5: and can be quite difficult to prevent. Whenever you accept user data
! 6: and somehow display this data back to users, you are likely vulnerable
! 7: to XSS hacks.
! 8:
! 9: The Input Filter support in PHP 5 is aimed at providing the framework
! 10: through which a company-wide or site-wide security policy can be
! 11: enforced. It is implemented as a SAPI hook and is called from the
! 12: treat_data and post handler functions. To implement your own security
! 13: policy you will need to write a standard PHP extension. There is also
! 14: a powerful standard implementation in ext/filter that should suit most
! 15: peoples' needs. However, if you want to implement your own security
! 16: policy, read on.
! 17:
! 18: A simple implementation might look like the following. This stores the
! 19: original raw user data and adds a my_get_raw() function while the normal
! 20: $_POST, $_GET and $_COOKIE arrays are only populated with stripped
! 21: data. In this simple example all I am doing is calling strip_tags() on
! 22: the data. If register_globals is turned on, the default globals that
! 23: are created will be stripped ($foo) while a $RAW_foo is created with the
! 24: original user input.
! 25:
! 26: ZEND_BEGIN_MODULE_GLOBALS(my_input_filter)
! 27: zval *post_array;
! 28: zval *get_array;
! 29: zval *cookie_array;
! 30: ZEND_END_MODULE_GLOBALS(my_input_filter)
! 31:
! 32: #ifdef ZTS
! 33: #define IF_G(v) TSRMG(my_input_filter_globals_id, zend_my_input_filter_globals *, v)
! 34: #else
! 35: #define IF_G(v) (my_input_filter_globals.v)
! 36: #endif
! 37:
! 38: ZEND_DECLARE_MODULE_GLOBALS(my_input_filter)
! 39:
! 40: zend_function_entry my_input_filter_functions[] = {
! 41: PHP_FE(my_get_raw, NULL)
! 42: {NULL, NULL, NULL}
! 43: };
! 44:
! 45: zend_module_entry my_input_filter_module_entry = {
! 46: STANDARD_MODULE_HEADER,
! 47: "my_input_filter",
! 48: my_input_filter_functions,
! 49: PHP_MINIT(my_input_filter),
! 50: PHP_MSHUTDOWN(my_input_filter),
! 51: NULL,
! 52: PHP_RSHUTDOWN(my_input_filter),
! 53: PHP_MINFO(my_input_filter),
! 54: "0.1",
! 55: STANDARD_MODULE_PROPERTIES
! 56: };
! 57:
! 58: PHP_MINIT_FUNCTION(my_input_filter)
! 59: {
! 60: ZEND_INIT_MODULE_GLOBALS(my_input_filter, php_my_input_filter_init_globals, NULL);
! 61:
! 62: REGISTER_LONG_CONSTANT("POST", PARSE_POST, CONST_CS | CONST_PERSISTENT);
! 63: REGISTER_LONG_CONSTANT("GET", PARSE_GET, CONST_CS | CONST_PERSISTENT);
! 64: REGISTER_LONG_CONSTANT("COOKIE", PARSE_COOKIE, CONST_CS | CONST_PERSISTENT);
! 65:
! 66: sapi_register_input_filter(my_sapi_input_filter);
! 67: return SUCCESS;
! 68: }
! 69:
! 70: PHP_RSHUTDOWN_FUNCTION(my_input_filter)
! 71: {
! 72: if(IF_G(get_array)) {
! 73: zval_ptr_dtor(&IF_G(get_array));
! 74: IF_G(get_array) = NULL;
! 75: }
! 76: if(IF_G(post_array)) {
! 77: zval_ptr_dtor(&IF_G(post_array));
! 78: IF_G(post_array) = NULL;
! 79: }
! 80: if(IF_G(cookie_array)) {
! 81: zval_ptr_dtor(&IF_G(cookie_array));
! 82: IF_G(cookie_array) = NULL;
! 83: }
! 84: return SUCCESS;
! 85: }
! 86:
! 87: PHP_MINFO_FUNCTION(my_input_filter)
! 88: {
! 89: php_info_print_table_start();
! 90: php_info_print_table_row( 2, "My Input Filter Support", "enabled" );
! 91: php_info_print_table_row( 2, "Revision", "$Revision: 222526 $");
! 92: php_info_print_table_end();
! 93: }
! 94:
! 95: /* The filter handler. If you return 1 from it, then PHP also registers the
! 96: * (modified) variable. Returning 0 prevents PHP from registering the variable;
! 97: * you can use this if your filter already registers the variable under a
! 98: * different name, or if you just don't want the variable registered at all. */
! 99: SAPI_INPUT_FILTER_FUNC(my_sapi_input_filter)
! 100: {
! 101: zval new_var;
! 102: zval *array_ptr = NULL;
! 103: char *raw_var;
! 104: int var_len;
! 105:
! 106: assert(*val != NULL);
! 107:
! 108: switch(arg) {
! 109: case PARSE_GET:
! 110: if(!IF_G(get_array)) {
! 111: ALLOC_ZVAL(array_ptr);
! 112: array_init(array_ptr);
! 113: INIT_PZVAL(array_ptr);
! 114: }
! 115: IF_G(get_array) = array_ptr;
! 116: break;
! 117: case PARSE_POST:
! 118: if(!IF_G(post_array)) {
! 119: ALLOC_ZVAL(array_ptr);
! 120: array_init(array_ptr);
! 121: INIT_PZVAL(array_ptr);
! 122: }
! 123: IF_G(post_array) = array_ptr;
! 124: break;
! 125: case PARSE_COOKIE:
! 126: if(!IF_G(cookie_array)) {
! 127: ALLOC_ZVAL(array_ptr);
! 128: array_init(array_ptr);
! 129: INIT_PZVAL(array_ptr);
! 130: }
! 131: IF_G(cookie_array) = array_ptr;
! 132: break;
! 133: }
! 134: Z_STRLEN(new_var) = val_len;
! 135: Z_STRVAL(new_var) = estrndup(*val, val_len);
! 136: Z_TYPE(new_var) = IS_STRING;
! 137:
! 138: var_len = strlen(var);
! 139: raw_var = emalloc(var_len+5); /* RAW_ and a \0 */
! 140: strcpy(raw_var, "RAW_");
! 141: strlcat(raw_var,var,var_len+5);
! 142:
! 143: php_register_variable_ex(raw_var, &new_var, array_ptr TSRMLS_DC);
! 144:
! 145: php_strip_tags(*val, val_len, NULL, NULL, 0);
! 146:
! 147: *new_val_len = strlen(*val);
! 148: return 1;
! 149: }
! 150:
! 151: PHP_FUNCTION(my_get_raw)
! 152: {
! 153: long arg;
! 154: char *var;
! 155: int var_len;
! 156: zval **tmp;
! 157: zval *array_ptr = NULL;
! 158: HashTable *hash_ptr;
! 159: char *raw_var;
! 160:
! 161: if(zend_parse_parameters(2 TSRMLS_CC, "ls", &arg, &var, &var_len) == FAILURE) {
! 162: return;
! 163: }
! 164:
! 165: switch(arg) {
! 166: case PARSE_GET:
! 167: array_ptr = IF_G(get_array);
! 168: break;
! 169: case PARSE_POST:
! 170: array_ptr = IF_G(post_array);
! 171: break;
! 172: case PARSE_COOKIE:
! 173: array_ptr = IF_G(post_array);
! 174: break;
! 175: }
! 176:
! 177: if(!array_ptr) RETURN_FALSE;
! 178:
! 179: /*
! 180: * I'm changing the variable name here because when running with register_globals on,
! 181: * the variable will end up in the global symbol table
! 182: */
! 183: raw_var = emalloc(var_len+5); /* RAW_ and a \0 */
! 184: strcpy(raw_var, "RAW_");
! 185: strlcat(raw_var,var,var_len+5);
! 186: hash_ptr = HASH_OF(array_ptr);
! 187:
! 188: if(zend_hash_find(hash_ptr, raw_var, var_len+5, (void **)&tmp) == SUCCESS) {
! 189: *return_value = **tmp;
! 190: zval_copy_ctor(return_value);
! 191: } else {
! 192: RETVAL_FALSE;
! 193: }
! 194: efree(raw_var);
! 195: }
! 196:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to README.input_filter CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php