Path: csiph.com!news.mixmin.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: Thomas 'PointedEars' Lahn Newsgroups: comp.lang.php Subject: Re: PHP processing steps to apply to a URL to make it safe Date: Thu, 18 Feb 2016 22:03:05 +0100 Organization: PointedEars Software (PES) Lines: 59 Message-ID: <1703763.CG5OWGaxa9@PointedEars.de> References: <28000155.9IakGmh2Vy@PointedEars.de> Reply-To: Thomas 'PointedEars' Lahn Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8Bit X-Trace: solani.org 1455829387 15472 eJwFwQkBwDAIA0BLPE3AzqCLfwm9Q9K5dQgeCBoZRjQiyrTp+HO8QmgL3QDu19FdW9MuexPWEKA= (18 Feb 2016 21:03:07 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Thu, 18 Feb 2016 21:03:07 +0000 (UTC) User-Agent: KNode/4.14.2 X-User-ID: eJwNwoERACEIA7CVQFss4wCe+4/wfwl3eMxBMMD3Q6dNDRVK3idD1jwYPLL90kLLWlk4XKKgmzQt753T8wEyoxRa Cancel-Lock: sha1:gjzwd7rhDxrbeLoUc2XKgK68MCw= X-NNTP-Posting-Host: eJwFwYEBgEAIAsCVIkXfcaJk/xG6YxTq7SxW0rSCs/gO4JydWIO9UOiwbmY/vhw9eiUy4wcW1RDe Xref: csiph.com comp.lang.php:16511 James Harris wrote: > On 17/02/2016 22:26, Thomas 'PointedEars' Lahn wrote: >> James Harris wrote: >>> I have been working with $_SERVER["REQUEST_URI"], in case that is >>> relevant. >> It is relevant: Do not do that. Request parameter values are provided in >> properly decoded form through specific superglobal arrays such as $_GET, >> and the $_SERVER['PATH_INFO'] value. > > No good. PATH_INFO does not contain the query string, AIUI, whereas > REQUEST_URI does. > > ... There is no need for a "query string" if you use PATH_INFO. Whether the latter is feasible with your server setup and use-case I do not know yet. >>> trim "/" from the ends in order to normalise >> Nonsense. > > Is it *guaranteed* that $_SERVER["REQUEST_URI"] will return a string > with a leading slash? Yes, see RFCs 1945 (HTTP/1.0), 2616 (HTTP/1.1), and 7540 (HTTP/2). Your server-side PHP script would not be executed if the request URI would not refer to it in some way. But trimming “/” from the end*s* is a different issue as that includes *trailing* slashes. >>> check there are no .. parts >> >> Why? That is _not_ a proper measure to make sure that code does not >> perform >> filesystem access above the DOCUMENT_ROOT. It smells of unsafe >> include/require. Fix the problem, not the symptom. > > No, that's not the reason. OK, you need to explain your use-case then if you would like an informed opinion from me. I do not have time to look for it in the rest of the thread and perhaps not find it there. >>> All needed? Any not needed? Latest firefox strips out any .. entries >>> before sending the URL but I am not sure that all earlier browsers >>> would. >> Please read the PHP Manual on security, and visit to >> get yourself a minimum clue. > > Thanks for the link. You’re welcome. -- PointedEars Zend Certified PHP Engineer | Twitter: @PointedEars2 Please do not cc me. / Bitte keine Kopien per E-Mail.