Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:33275
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain porcupine.org from 168.100.189.2 cause and error)
DomainKey-Status: good
DomainKey-Signature: a=rsa-sha1; s=dktest; d=porcupine.org; c=simple; q=dns;
	h=subject:in-reply-to:to:date:cc:x-time-zone:x-mailer:
	mime-version:content-transfer-encoding:content-type:message-id:from;
	b=v2EUB71rvlmQ1DOxgn0quOLjVUg67ZIVYMd9tlm2TQ3PBywcgoupYlw3cZDd+cdKk
	UnWsmfQycW+8mLoOD3hNs1q1A8ORWokfMOphBMSWldxqkvz6nzx/0RiAgow9h6KQbj9
	xSSAiyBufey9qsBwrWwJN/JKB40hGzbynu+xlYw=
In-Reply-To: <47401946.2050406@sektioneins.de> "from Stefan Esser at Nov 18,
 2007 11:51:50 am"
To: Stefan Esser <stefan.esser@sektioneins.de>
Date: Sun, 18 Nov 2007 20:49:41 -0500 (EST)
CC: PHP internals <internals@lists.php.net>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
Message-ID: <20071119014941.6D8AE1F3E97@spike.porcupine.org>
Subject: Re: [PHP-DEV] Tainted Mode Decision
From: wietse@porcupine.org ((Wietse Venema))
References: <47401946.2050406@sektioneins.de>

Stefan Esser:
> 2) Using mysql_real_escape_string() on user input does not make it safe
> for SQL. It only makes SQL strings safe.
> Example: "SELECT * FROM table WHERE id=".mysql_real_escape_string($id)  
> is NOT secure but will result in no taint warning

Can you give a specific example? I'd like to know how likely such
things would be in real code.

> 3) Using htmlentities() on usr input does not make it safe for HTML
> output. It only makes it safe in some situations.
> Example:  echo '....<sometag  style="some-attribute:
> ',htmlentities($user_input),'">'. Will allow XSS through the style
> attribute without a taint warning
> Example2:  echo '....<img src="',htmlentities($user_input),'">'. Will
> allow XSS through javascript: URL (f.e. in Opera) without a taint warning

Or they could encrypt the entire URL and include a decryptor
(javascript or some other language) in the HTML text. Detecting
threats that involve script/applet/etc execution requires the
ability to realistically simulate every browser. I haven't
solved that one yet.

That doesn't mean that I should give up trying to warn people about
known-to-be-bad coding practices. I just can't warn them about all
possible ways to screw up. 

	Wietse