Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94131
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.48 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
 <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
 <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
 <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
 <57665E36.60302@lsces.co.uk> <CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com>
 <5766D311.6030503@lsces.co.uk> <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
Date: Sun, 19 Jun 2016 10:48:57 -0700
Message-ID: <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com>
To: Scott Arciszewski <scott@paragonie.com>
Cc: Lester Caine <lester@lsces.co.uk>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1143ccf0df8e610535a533b1
Subject: Re: [PHP-DEV] New escaped output operator
From: walterp@gmail.com (Walter Parker)

--001a1143ccf0df8e610535a533b1
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

From your story Scott, it looks like the failure was bad input filtering,
not input filtering in general. If sites are really trying to be secure,
they should follow both Lester's and your ideas and filter on input and
escape on output.

Given your second link the better suggestion is to stop taking raw HTML.
Assuming user generated HTML is ever safe to re-render in an output page
has been a bad idea for years. Ebay/paypal once thought that stripping all
letters and numbers from JavaScript was enough to make it safe, it wasn't.
Somebody used just things like (){}[]=3D+ to build functional attack script=
s.

While a simple method of output escaping seems like a good idea, I agree
with the others that point out that is one of those security systems where
getting it 90% correct is worse that not doing anything at all. Things like
this will cause people to be blindsided when the uncaught escapes cause the
next major security problem.


Walter

On Sun, Jun 19, 2016 at 10:28 AM, Scott Arciszewski <scott@paragonie.com>
wrote:

> On Sun, Jun 19, 2016 at 1:14 PM, Lester Caine <lester@lsces.co.uk> wrote:
>
> > On 19/06/16 10:01, Marco Pivetta wrote:
> > > This basically means that you lack basic understanding of how escapin=
g
> > and
> > > user input are to be handled.
> > > Most apps out there about getting a bunch of text from the user, then
> > > rendering it somewhere else in the app.
> > > Cleaning user input just leads to frustration and a big mess in most
> > > scenarios, which is why we're all talking about escaping output
> instead.
> > > This is not "cleaning" either, it's escaping, which is a
> non-destructive
> > > and reversible operation (which is why it works so well).
> >
> > Well we have to disagree ... simply expecting htmlspecialchars() to fix
> > all your problems without proper handling of the input text is 'the big
> > mess' and there is NO need to simply slap htmlspecialchars() onto
> > properly built data so the idea that <?=3D should automatically add it =
is
> > totally pointless!
> >
> > --
> > Lester Caine - G8HFL
> > -----------------------------
> > Contact - http://lsces.co.uk/wiki/?page=3Dcontact
> > L.S.Caine Electronic Services - http://lsces.co.uk
> > EnquirySolve - http://enquirysolve.com/
> > Model Engineers Digital Workshop - http://medw.co.uk
> > Rainbow Digital Media - http://rainbowdigitalmedia.co.uk
> >
> > --
> > PHP Internals - PHP Runtime Development Mailing List
> > To unsubscribe, visit: http://www.php.net/unsub.php
> >
> >
> =E2=80=8BLet me tell you a story.
>
> Once upon a time, WordPress decided to escape user input to protect again=
st
> XSS attacks. Then this happened: https://klikki.fi/adv/wordpress2.html
> (Stored XSS via MySQL Column Truncation vulnerability.)
>
> Escaping against XSS attacks should happen on output, not on input. Dead
> stop.
>
> You MAY cache the escaped output for performance gains, but keep the
> unescaped data in the database in case you need to adjust your escaping
> strategy without mangling existing data.
>
> Further reading:
>
> https://paragonie.com/blog/2015/06/preventing-xss-vulnerabilities-in-php-=
everything-you-need-know
> =E2=80=8B
>
> Scott Arciszewski
> Chief Development Officer
> Paragon Initiative Enterprises <https://paragonie.com/>=E2=80=8B
>



--=20
The greatest dangers to liberty lurk in insidious encroachment by men of
zeal, well-meaning but without understanding.   -- Justice Louis D. Brandei=
s

--001a1143ccf0df8e610535a533b1--