Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63109
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.170 as permitted sender)
MIME-Version: 1.0
Sender: mikegstowe@gmail.com
In-Reply-To: <5058C809.50005@lsces.co.uk>
References: <CALwr1Gn4OmHP=Qa7NKzpbkq+w8FEjUMZ3v678bbZVOGM23G35g@mail.gmail.com>
 <5058A697.30903@sugarcrm.com> <CAAyV7nF82MW1gRpVpiVooCNyj7YE-eVDqjzqFX0m3X1J7Kp_UA@mail.gmail.com>
 <5058A8B8.3070404@sugarcrm.com> <5058A97A.4080900@ajf.me> <5058AABA.1040406@sugarcrm.com>
 <CAAyV7nHgJku5MqKY-D_Gk+DaSt-Wda3BJHsSzyS=yW6xENRi6w@mail.gmail.com>
 <5058B5A5.6090302@sugarcrm.com> <5058BA43.8010806@mrclay.org>
 <5058BBA6.4090702@sugarcrm.com> <CAAyV7nGZ2iinDUcUfsVeBxFC_2nF8TmbaDrMDQTK0dkmnLifow@mail.gmail.com>
 <5058C809.50005@lsces.co.uk>
Date: Tue, 18 Sep 2012 14:29:28 -0500
Message-ID: <CAH8KiXJUGJyhUYuUM4LTzSTXiJ+9M31e1GMvVbhEOkwH=+OcAw@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f46d04016c23d9ba8d04c9fee939
Subject: Re: [PHP-DEV] RFC: Implementing a core anti-XSS escaping class
From: me@mikestowe.com (Michael Stowe)

--f46d04016c23d9ba8d04c9fee939
Content-Type: text/plain; charset=ISO-8859-1

*Basically if you are STORING XSS intrusions then you have badly designed
code as there is no reason that it would be stored. If you want to
'display' suspect code, then it is 'escaped' before it is stored so
preventing a potential problem if another viewer accesses the raw data!*


While that is true, there is always the risk of code being injected into
your data-store through another source or being initially bypassed
somewhere on your script.  So yes, you absolutely want to have the correct
filters and sanitation in place prior to storing, but as an added
precaution I think it is wise to be always escaping data prior to output as
well.

- Mike


On Tue, Sep 18, 2012 at 2:14 PM, Lester Caine <lester@lsces.co.uk> wrote:

> Anthony Ferrara wrote:
>
>> Personally, I'd rather have a dedicated API. It's the only way that
>> semantic meaning of the API will be preserved.
>>
>> In this case, I would start it as a PECL extension implementing the ESAPI
>> library. Get the API right, and prove it works, then pull it into core.
>>
>
> Sounds the right way to placate the people who prefer this approach to
> building code. We then have the option to leave it off if we don't use it
> ;) I've even got a stock distribution that does not include any MySQL core
> stuff now so I'm happy with this modular approach.
>
>
>  You can keep cramming the escaping concerns into a global filter handler
>> all you want. Or we could stop, and think about designing proper APIs for
>> a
>> change. Where the API imparts both implementation and semantic meaning. An
>> API where it's easy to see if a user gets it right or not.
>>
>
> Looking at the output 'filtering' applied to my own systems, I am more
> than happy that ACTUALLY I eliminate the problems people are quoting here,
> XSS prevention, by ensuring that the data being STORED is cleaned up in a
> way that I don't need to 'escape' anything. I do need to be able to
> 'encode' the output date to correctly display it but nothing in that
> process should be able to create an XSS problem? I do apply 'filtering' to
> the html tags which removes those that I do not want to be stored in page
> content, and css is similarly processed, so we have a run time dictionary
> that controls the processing rather than that being hard coded in the
> filters.
>
> Basically if you are STORING XSS intrusions then you have badly designed
> code as there is no reason that it would be stored. If you want to
> 'display' suspect code, then it is 'escaped' before it is stored so
> preventing a potential problem if another viewer accesses the raw data!
>
>
> --
> Lester Caine - G8HFL
> -----------------------------
> Contact - http://lsces.co.uk/wiki/?page=**contact<http://lsces.co.uk/wiki/?page=contact>
> L.S.Caine Electronic Services - http://lsces.co.uk
> EnquirySolve - http://enquirysolve.com/
> Model Engineers Digital Workshop - http://medw.co.uk
> Rainbow Digital Media - http://rainbowdigitalmedia.co.**uk<http://rainbowdigitalmedia.co.uk>
>
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


-- 
-----------------------

"My command is this: Love each other as I
have loved you."                         John 15:12

-----------------------

--f46d04016c23d9ba8d04c9fee939--