Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118647
Message-ID: <6722BFBE-84F7-4A6F-AA9F-4C5012251FBF@craigfrancis.co.uk>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_2F51738D-8379-42C5-9E8E-09F7898AFD4B"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
Date: Sat, 17 Sep 2022 12:14:48 +0100
In-Reply-To: <a7544016-5520-2598-06ec-5715064d84ba@bastelstu.be>
Cc: php internals <internals@lists.php.net>
To: =?utf-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>
References: <8479bc9a-6ed6-0cf1-c727-123e2b87a8d6@dafert.at>
 <7e250e89-c18e-9e1a-222a-60521dd2babb@nunninger.info>
 <DEC09231-FDEB-4EDC-A8F3-B9F714112480@dafert.at>
 <6aa89b49-fde5-4779-94e4-97b8b856d02e@www.fastmail.com>
 <CAMrTa2EKkDER30fkpinOgKkHMLTH-QgPEZai0u-9VfTon9c_1A@mail.gmail.com>
 <a82a0fce-2a37-8187-b028-52f989557a2e@bastelstu.be>
 <CAMrTa2Fd7Lu59nOY_SHDkTvg19kn-kf=+ZoU51AgL8cXvD-mMQ@mail.gmail.com>
 <a7544016-5520-2598-06ec-5715064d84ba@bastelstu.be>
Subject: Re: [PHP-DEV] Error behaviour for max_input_vars
From: craig@craigfrancis.co.uk (Craig Francis)

--Apple-Mail=_2F51738D-8379-42C5-9E8E-09F7898AFD4B
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On 14 Sep 2022, at 20:55, Tim D=C3=BCsterhus <tim@bastelstu.be> wrote:
> As indicated by the phrasing in my previous email, this knowledge does =
not enable an attacker to do anything that they wouldn't be able to do =
otherwise.


One possibility... when you say the attacker is able to "not send all =
the fields", would that be via injecting malicious JavaScript? which =
would hopefully be blocked via the websites Content Security Policy?... =
a different approach could use a simple XSS within the <form>, and =
injecting ~995 hidden <input> fields:

```
<form action=3D"/user/edit" method=3D"post">
  [...]
  <input type=3D"hidden" name=3D"xss[]" />
  <input type=3D"hidden" name=3D"xss[]" />
  <input type=3D"hidden" name=3D"xss[]" />
  [...]
  <label>
    <input type=3D"checkbox" name=3D"group_delete[]" value=3D"1" />
    Remove from Group 1
  </label>
  [...]
</form>
```

Craig=

--Apple-Mail=_2F51738D-8379-42C5-9E8E-09F7898AFD4B--