Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94133
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <b9318b90-f850-12a2-459d-8995220922df@gmail.com> <20160617202344.2868F1A80C02@dd1730.kasserver.com>
 <CAObuZdvZoACWE1bxz2PUMW+yXHxyEtXuYpPXL=6dEqrsakSNBQ@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
 <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
 <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
 <57665E36.60302@lsces.co.uk> <CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com>
 <5766D311.6030503@lsces.co.uk> <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
 <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com>
Date: Sun, 19 Jun 2016 23:33:51 +0500
Message-ID: <CAEDdnaUi5hvOAkkPWWk3YVNxMjsCbntB-W70a8sPXFkKHJGY8w@mail.gmail.com>
To: Walter Parker <walterp@gmail.com>
Cc: Scott Arciszewski <scott@paragonie.com>, Lester Caine <lester@lsces.co.uk>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113ff1705f21670535a5d457
Subject: Re: [PHP-DEV] New escaped output operator
From: michael.vostrikov@gmail.com (=?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?=)

--001a113ff1705f21670535a5d457
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Lester

> there is NO need to simply slap htmlspecialchars() onto
> properly built data

There are many cases when user data can contain quotes or other html
entities.

<img title=3D"<?=3D $book['title'] ?>" />
// $book['title'] =3D 'When we say "Hello"';

<div><?=3D $user['about_me'] ?></div>
// $user['about_me'] =3D 'I am a programmer. I like to write
<script>alert("xss")</script> in "About me" field';


Walter

> where getting it 90% correct is worse that not doing anything at all.
> Things like this will cause people to be blindsided when the uncaught
escapes
> cause the next major security problem.

Why do you think so? What real problems can happen if there will be a short
operator for htmlspecialchars()?


2016-06-19 22:48 GMT+05:00 Walter Parker <walterp@gmail.com>:

> From your story Scott, it looks like the failure was bad input filtering,
> not input filtering in general. If sites are really trying to be secure,
> they should follow both Lester's and your ideas and filter on input and
> escape on output.
>
> Given your second link the better suggestion is to stop taking raw HTML.
> Assuming user generated HTML is ever safe to re-render in an output page
> has been a bad idea for years. Ebay/paypal once thought that stripping al=
l
> letters and numbers from JavaScript was enough to make it safe, it wasn't=
.
> Somebody used just things like (){}[]=3D+ to build functional attack scri=
pts.
>
> While a simple method of output escaping seems like a good idea, I agree
> with the others that point out that is one of those security systems wher=
e
> getting it 90% correct is worse that not doing anything at all. Things li=
ke
> this will cause people to be blindsided when the uncaught escapes cause t=
he
> next major security problem.
>
>
> Walter
>
> On Sun, Jun 19, 2016 at 10:28 AM, Scott Arciszewski <scott@paragonie.com>
> wrote:
>
> > On Sun, Jun 19, 2016 at 1:14 PM, Lester Caine <lester@lsces.co.uk>
> wrote:
> >
> > > Well we have to disagree ... simply expecting htmlspecialchars() to f=
ix
> > > all your problems without proper handling of the input text is 'the b=
ig
> > > mess' and there is NO need to simply slap htmlspecialchars() onto
> > > properly built data so the idea that <?=3D should automatically add i=
t is
> > > totally pointless!
> > >
> > > --
> > > Lester Caine - G8HFL
> > > -----------------------------
> > > Contact - http://lsces.co.uk/wiki/?page=3Dcontact
> > > L.S.Caine Electronic Services - http://lsces.co.uk
> > > EnquirySolve - http://enquirysolve.com/
> > > Model Engineers Digital Workshop - http://medw.co.uk
> > > Rainbow Digital Media - http://rainbowdigitalmedia.co.uk
> > >
> > > --
> > > PHP Internals - PHP Runtime Development Mailing List
> > > To unsubscribe, visit: http://www.php.net/unsub.php
> > >
> > >
> > =E2=80=8BLet me tell you a story.
> >
> > Once upon a time, WordPress decided to escape user input to protect
> against
> > XSS attacks. Then this happened: https://klikki.fi/adv/wordpress2.html
> > (Stored XSS via MySQL Column Truncation vulnerability.)
> >
> > Escaping against XSS attacks should happen on output, not on input. Dea=
d
> > stop.
> >
> > You MAY cache the escaped output for performance gains, but keep the
> > unescaped data in the database in case you need to adjust your escaping
> > strategy without mangling existing data.
> >
> > Further reading:
> >
> >
> https://paragonie.com/blog/2015/06/preventing-xss-vulnerabilities-in-php-=
everything-you-need-know
> > =E2=80=8B
> >
> > Scott Arciszewski
> > Chief Development Officer
> > Paragon Initiative Enterprises <https://paragonie.com/>=E2=80=8B
> >
>
>
>
> --
> The greatest dangers to liberty lurk in insidious encroachment by men of
> zeal, well-meaning but without understanding.   -- Justice Louis D.
> Brandeis
>

--001a113ff1705f21670535a5d457--