Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72160
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.173 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <52F02499.3000004@lsces.co.uk>
References: <CAGa2bXbFk3+ScywpkeGcFUcmVvxLRHeWrdObvOshx6NjuB2YHw@mail.gmail.com>
	<52EDBB30.3070209@ajf.me>
	<CAGa2bXYMPM2+HinAANcDv2gvGNtfPHYFcKr=qrmXrsRPEbsiog@mail.gmail.com>
	<52EE1C2B.7030702@sugarcrm.com>
	<CAGa2bXYJAz8jMRmL4d9uHvspzg12km=ZosBtvqwywwc1wzmVuw@mail.gmail.com>
	<52EF50B6.1030404@sugarcrm.com>
	<CAGa2bXakB1YY4kxJc87m2tzjDjLGkw93QV2WfiN+9XAGUYxQ-A@mail.gmail.com>
	<52F014C3.4060007@sugarcrm.com>
	<CAGa2bXbV-dzCRq7uoyjme9_ufyK-cqAGzMTOw98JpBoVRCe0hA@mail.gmail.com>
	<52F01716.2040304@sugarcrm.com>
	<CAGa2bXb6Dfqko98Z7=xYyUghCdg-7Lk3TE4BQL6_JCzvxsau8g@mail.gmail.com>
	<52F02499.3000004@lsces.co.uk>
Date: Tue, 4 Feb 2014 00:20:19 +0000
Message-ID: <CALwr1GnbCuOGBjh2dBLz+LZnf0CGkRxiV4xA_TNf-5d39=+M8g@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC] Improve HTML escape
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Lester,

On 3 February 2014 23:22, Lester Caine <lester@lsces.co.uk> wrote:
> Yasuo Ohgaki wrote:
>>
>> I'm lost here.
>> OWASP suggests to escape at least
>>
>>   & --> &amp;
>>   < --> &lt;
>>   > --> &gt;
>>   " --> &quot;
>>   ' --> &#x27;     &apos; not recommended because its not in the HTML sp=
ec
>> (See: section 24.4.1) &apos; is in the XML and XHTML specs.
>>   / --> &#x2F;     forward slash is included as it helps end an HTML
>> entity
>>
>>
>> https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Ch=
eat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML=
_Element_Content
>>
>> I'm not sure why you state "already violate this requirement".
>
>
> It may be that what you are asking for is a flag on htmlentities for 'OWA=
SP'
> compliant option. Others would probably view that as not then being html5
> compliant since html5 has it's own list of 'escaped' characters. One of t=
he
> irritating things I find is 'unescaping' a string does not return the
> original string simply because the html5 rule has not been followed! A cl=
ean
> html5 result should be the default.

OWASP compliance focuses on the special characters which are the same
regardless of HTML spec. What is output MAY differ which is why it
suggests something like hex encoding where differences between specs
exist.

> Looking at the Rule 2 from the OWASP they are actually asking for every
> character below 256 to be escaped when used in an attribute! But the
> important thing here is 'untrusted' data, and sanitising any externally
> supplied data needs a little more care than simply trying to wrap it in
> htmlentities which I think is what Stas is saying? Personally I try to av=
oid
> any path where input can be processed direct back to output, filter the
> input, don't simply try and patch the output?

It's not a question of validating/filtering input. Handling input
get's it into the application where Mystery Process 1 - Infinity are
performed. Who knows what these Mystery Processes do? I don't - I'm
not writing everyones application for them! They could be grabbing
data, transforming it, reading from the database, using a Composer
package replaced en route by the NSA, etc. Ergo, we escape on output
to HTML/JSON at all times and without exception. The same way we
escape on output and without exception when the output target is a
database. Input and Output are like borders - nobody gets across them
without a customs check. It may seem unnecessary at times but that's
because most of the point is to consistent to a fault to eliminate the
risk of any errors in those Mystery Processes and to guarantee that
the correct escaping is performed - DB? JSON? HTML? XML? RPC? Command
Line?

Also helps not having to dissect every single application route just
to figure out every input's output encoding... That just drives me
nuts, and I have seen it. It's easy to forget sometimes that other
people have to maintain and audit your applications at times, so go
easy on them!

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative