FUDforum: comp.lang.php » Help with Security Have I coded this correctly?

Home » Imported messages » comp.lang.php » Help with Security Have I coded this correctly?

Show: Today's Messages :: Polls :: Message Navigator

Re: Help with Security Have I coded this correctly? [message #182072 is a reply to message #182069]

Wed, 03 July 2013 17:42

Timothy
Messages: 3
Registered: June 2013

Karma:

Junior Member

On Tue, 02 Jul 2013 23:50:44 -0700, chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com

Wow! That site looks very neat!

> Though I have checked all security aspects … do you experts see any
> major flaw that I need to care of?

I would only whitelist allowable patterns/functions. I it very plausible
to miss an attack/harmful function in a blacklist.

For example I could partially read your source code by running:
<?php
readfile("exec.php");
?>

I could not test your script reliably, because sometimes 'exec.php'
throws an Apache 403 Forbidden error.

Be sure to disable include/require and the *_once variant, because they
might include a remote script.

Timothy

Report message to a moderator

[Message index]

		Help with Security Have I coded this correctly? By: chirag sharma on Wed, 03 July 2013 06:50
		Re: Help with Security Have I coded this correctly? By: Arno Welzel on Wed, 03 July 2013 15:05
		Re: Help with Security Have I coded this correctly? By: bill on Wed, 03 July 2013 16:31
		Re: Help with Security Have I coded this correctly? By: Arno Welzel on Tue, 09 July 2013 14:20
		Re: Help with Security Have I coded this correctly? By: Timothy on Wed, 03 July 2013 17:42
		Re: Help with Security Have I coded this correctly? By: Christoph Michael Bec on Wed, 03 July 2013 17:52
		Re: Help with Security Have I coded this correctly? By: Daniel Pitts on Wed, 03 July 2013 18:12
		Re: Help with Security Have I coded this correctly? By: Christoph Michael Bec on Wed, 03 July 2013 18:35
		Re: Help with Security Have I coded this correctly? By: kishorguru99pvtltd on Mon, 08 July 2013 08:49
		Re: Help with Security Have I coded this correctly? By: Jerry Stuckle on Mon, 08 July 2013 12:48

Previous Topic:	Consumir Web Service usando SoapClient y Certificados jsk
Next Topic:	How can i get value of text area?

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Sat Nov 09 16:46:28 GMT 2024

Total time taken to generate the page: 0.05060 seconds