Cross-Site Scripting? In PHP Notices? It's more likely than you think

Re:Cross-Site Scripting? In PHP Notices? It's more likely th... by pilif on Thursday August 18, 2011 @02:20AM (#2898207)

So with this I can XSS myself while in development mode on my development system? That's handy.

There are so many good reasons to turn off display_error during production use, one of which is to not have a broken page due to errors appearing all over the place which even the laziest PHP developer who only cares about "stuff working" would appreciate.

That it also leaks important internal information is another side-effect which generally isn't as appreciated though.

Also the article is showing this code:

    // Undefined function
    error_reporting(E_ALL);
    echo $_GET['funct']();

which they admit is a "rarely used pattern". I would certainly hope so as it is also only marginally better than

    eval($_GET['data']);

or just

    echo "the root password for this machine is: pAsswoRd";

[ Parent | on HN ]

Re:Cross-Site Scripting? In PHP Notices? It's more likely th... by nbpoole on Thursday August 18, 2011 @02:24AM (#2898215)

> So with this I can XSS myself while in development mode on my development system? That's handy.

Or someone can send you a URL that points to your dev server and contains a payload. Or someone can send a URL to the developer across the street who uses shared hosting where display_errors is enabled by default.

I'm not arguing that this is a feasible attack to pull off against most applications: it most certainly is not. I'm arguing that it shouldn't be possible to pull it off at all, even in the small percentage of applications that might be affected. There is no good reason PHP should be displaying this information unsanitized.

---

You're 100% correct about the example you're pointing out. If you're allowing arbitrary functions called from the user, you're in much bigger trouble. ;-)

I originally noticed and reported the issue with the first example, which triggers a simple, common undefined index notice:

    <?php
    error_reporting(E_ALL);
    $array = array();
    echo $array[$_GET['index']];

I only included the others for the sake of completeness. I've updated the code sample to note that.

[ Parent | on HN ]

Re:Cross-Site Scripting? In PHP Notices? It's more likely th... by pilif on Thursday August 18, 2011 @02:33AM (#2898237)

> Or someone can send you a URL that points to your dev server and contains a payload.

That is theoretically possible, though what they would be able to do is to deal damage to my development install (if I don't to CSRF protection on POST operations) or they could potentially hijack my current session on my development system, which, too I don't deem too critical.

> who uses shared hosting where display_errors is enabled by default

   init_set('display_errors', 0);

Even on a shared host you can turn display_errors off.

> There is no good reason PHP should be displaying this information unsanitized.

I agree, especially because they already do some escaping of their own errors (and consequently don't escape while running in the CLI SAPI)

[ Parent | on HN ]

Re:Cross-Site Scripting? In PHP Notices? It's more likely th... by smsm42 on Thursday August 18, 2011 @04:00AM (#2898384)

Is there any other language that encodes its error messages so they are 100% XSS safe?

[ Parent | on HN ]

Re:Cross-Site Scripting? In PHP Notices? It's more likely th... by ricardosdl on Thursday August 18, 2011 @09:45AM (#2899138)

Unfortunately it doesn't seems a rarely used pattern:

http://www.google.com/codesearch#search/&q=%5C$_GET%5C%5...

[ Parent | on HN ]