sanitization | 易学教程

Script tags being rendered after purification in WYSIWYG

阅读更多关于 Script tags being rendered after purification in WYSIWYG

问题 I'm having an issue with using the HTMLPurifier php library. I'm using a WYSIWYG editor named 'Summernote' for all text areas on my application. When writing something inside sommernote like: <script>alert('test');</script> The post data comes through as <p><script>alert('test');</script></p> However, once this is ran through the HTMLPurifier, it doesn't remove the script tags that are converted into regular characters. So when I go to edit this text inside summernote, it actually runs the

How can I allow HTML in a whitelist with PHP

阅读更多关于 How can I allow HTML in a whitelist with PHP

问题 I know there is a lot of discussion for years on best methods of filtering data with PHP but I would like to go the whitelist approach in my current project. I only want a user to be able to use the following HTML <b>bold</b> <i>italics</i> <u>underline</u> <s>strikethrough</s> <big>Big size</big > <small>Small size</small> Hyperlink <a href="http://www.site.com">website</a> A Bulleted List: <ul> <li>One Item</li> <li>Another Item</li> </ul> An Ordered List: <ol> <li> First Item</li> <li>

What does FILTER_SANITIZE_STRING do?

阅读更多关于 What does FILTER_SANITIZE_STRING do?

There's like a million Q&A that explain the options like FILTER_FLAG_STRIP_LOW , but what does FILTER_SANITIZE_STRING do on its own, without any options? Does it just filter tags? According to PHP Manual : Strip tags, optionally strip or encode special characters. According to W3Schools : The FILTER_SANITIZE_STRING filter strips or encodes unwanted characters. This filter removes data that is potentially harmful for your application. It is used to strip tags and remove or encode unwanted characters. Now, that doesn't tell us much. Let's go see some PHP sources. ext/filter/filter.c : static

Preventing SQL Injection in C

阅读更多关于 Preventing SQL Injection in C

问题 I am writing a C application that takes some user input and does a few database queries. I am well aware of the risks here of SQL injection and wish to prevent it. Ideally I would use parameterized queries, but have been unable to find anything with this functionality in C so far. I am currently constructing my queries as such: char *query; asprintf(&query, "UPDATE SomeTable SET SomeField='%s';", userInput); If I am unable to do this, then I must need to filter the user input. How should this

How can sanitation that escapes single quotes be defeated by SQL injection in SQL Server?

阅读更多关于 How can sanitation that escapes single quotes be defeated by SQL injection in SQL Server?

To start this off, I am well aware that parameterized queries are the best option, but I am asking what makes the strategy I present below vulnerable. People insist the below solution doesn't work, so I am look for an example of why it wouldn't. If dynamic SQL is built in code using the following escaping before being sent to a SQL Server, what kind of injection can defeat this? string userInput= "N'" + userInput.Replace("'", "''") + "'" A similar question was answered here , but I don't believe any of the answers are applicable here. Escaping the single quote with a "\" isn't possible in SQL

Sanitize table/column name in Dynamic SQL in .NET? (Prevent SQL injection attacks)

阅读更多关于 Sanitize table/column name in Dynamic SQL in .NET? (Prevent SQL injection attacks)

I am generating some Dynamic SQL and would like to ensure that my code is safe from SQL injection . For sake of argument here is a minimal example of how it is generated: var sql = string.Format("INSERT INTO {0} ({1}) VALUES (@value)", tableName, columnName); In the above, tableName , columnName , and whatever is bound to @value come from an untrusted source. Since placeholders are being used @value is safe from SQL injection attacks, and can be ignored. (The command is executed via SqlCommand.) However, tableName and columnName cannot be bound as placeholders and are therefor vulnerable to

CSS and JQuery: spaces inside image name break code of url()

阅读更多关于 CSS and JQuery: spaces inside image name break code of url()

问题 I have a page that is supposed to display a larger version of an image when hovered over a thumbnail. I have a 'div' with an ID and the JQuery code is as following: $(document).ready(function(){ $('img').hover(function() { var src = $("#im" + this.id).attr("src"); $('#viewlarge').css('backgroundImage','url(' + src +')'); return false; }); }); The images I use, are generated by a Ruby script that "generate" an image with a similar, yet different id. However, sometimes, photo's are uploaded

Forming sanitary shell commands or system calls in Ruby

阅读更多关于 Forming sanitary shell commands or system calls in Ruby

问题 I'm building a daemon that will help me manage my server(s). Webmin works fine, as does just opening a shell to the server, but I'd prefer to be able to control server operations from a UI I design, and also expose some functionality to end users. The daemon will pick up actions from a queue and execute them. However, since I'll be accepting input from users, I want to make sure they're not permitted to inject something dangerous into a privileged shell command. Here's a fragment that

Best way to go about sanitizing user input in rails

阅读更多关于 Best way to go about sanitizing user input in rails

问题 I've read a lot about this and know there are many related questions on here, but I couldn't find a definitive guide for how to go about sanitizing everything. One option is to sanitize on insert, for example I have the following in my model before_validation :sanitize_content, :on => :create def sanitize_content self.content = ActionController::Base.helpers.sanitize(self.content) end Do I need to run this on every field in every model? I'm guessing the :on => :create should be removed too so

Sanitize user defined CSS in PHP

阅读更多关于 Sanitize user defined CSS in PHP

问题 I want to allow users to use their own stylesheets for thei profiles on my forum, but I'm afraid of possible security vulnerabilities. Does anyone have any tips for sanitizing CSS? Basic process: User enters CSS into form -> Save to DB -> Output as inline CSS 回答1: HTMLPurifier with CSSTidy does what you're looking for. HTMLPurifier is primarily designed for sanitizing HTML, but also has an option to extract style blocks with CSSTidy. There's an example in the HTMLPurifier docs (but alas, I've