Re:Cross-Site Scripting? In PHP Notices? It's more likely th...
by pilif on Thursday August 18, 2011 @02:33AM
(#2898237)
> Or someone can send you a URL that points to your dev server and contains a payload.
That is theoretically possible, though what they would be able to do is to deal damage to my development install (if I don't to CSRF protection on POST operations) or they could potentially hijack my current session on my development system, which, too I don't deem too critical.
> who uses shared hosting where display_errors is enabled by default
init_set('display_errors', 0);
Even on a shared host you can turn display_errors off.
> There is no good reason PHP should be displaying this information unsanitized.
I agree, especially because they already do some escaping of their own errors (and consequently don't escape while running in the CLI SAPI)
That is theoretically possible, though what they would be able to do is to deal damage to my development install (if I don't to CSRF protection on POST operations) or they could potentially hijack my current session on my development system, which, too I don't deem too critical.
> who uses shared hosting where display_errors is enabled by default
Even on a shared host you can turn display_errors off.> There is no good reason PHP should be displaying this information unsanitized.
I agree, especially because they already do some escaping of their own errors (and consequently don't escape while running in the CLI SAPI)