Re:pfSense: Open source network firewall distribution
by rgrove on Friday February 10, 2017 @02:20PM
(#13618051)
Why isn't `$id` HTML-escaped before being echoed in an HTML attribute context? That's a potential XSS vector. Slightly more difficult to exploit when pulled from `$_POST`, but still a problem.
[ Parent
| on HN ]
Re:pfSense: Open source network firewall distribution
by gonzo on Friday February 10, 2017 @02:35PM
(#13618174)
it's an example.
Re:pfSense: Open source network firewall distribution
by rgrove on Friday February 10, 2017 @02:54PM
(#13618332)
I don't mean to be combative, but when providing an example of how you're planning to mitigate vulnerabilities, it seems unwise to use code that contains an easily avoidable XSS vuln. I love pfSense and have used it for years, but this sort of thing doesn't inspire confidence.
Re:pfSense: Open source network firewall distribution
by gonzo on Friday February 10, 2017 @03:22PM
(#13618550)
Understood. It wasn't provided in the example, because it is not a user-entered item and is rarely displayed on the screen. It is typically an index. In other cases (perhaps) because people who originally wrote it knew no better.
(There is a lot if "isnumeric()" stuff used around $id. I inherited this codebase.)