Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #15257

Re: Check for a set of strings in a string - pregmatch ? if so how

Show all headers | View raw

Thomas 'PointedEars' Lahn wrote:

>> Richard Townsend-Rose:
>>> for years we checked against injection using
>>>
>>> if (eregi( "(%0D)|(%0A)|(0x0A)|(0x0D)|(MIME-Version)|
>>>           (Content-Type)|(Content-Transfer)|(Content-Disposition)|
>>>           (boundary=)|(Return-Path)", $var ) )
>
> But ISTM that the approach of using regular expressions or filters in PHP to 
> prevent e-mail injection is wrong in the first place.  Using a well-tested 
> mailer like PHPMailer instead of the mail() function directly, installing 
> and configuring the Suhosin patch, using a *current* PHP version with 
> stricter configuration settings, or using stricter configuration settings 
> for the system mailer (e.g. sendmail) are the better alternatives.  Those 
> can be combined, of course.

I agree that it is somewhat dangerous to rely solely on regular
expressions and filters to prevent all kinds of email injection attacks.

After having had a closer look at the regex given by Richard, it occurs
to me that the code doesn't prevent header injection in the general
case.  If I'm not mistaken 0x0A doesn't match a newline, and %0A has
most likely already been decoded by PHP.  The further special cases will
only prevent a few attacks.

-- 
Christoph M. Becker

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Check for a set of strings in a string - pregmatch ? if so how Richard Townsend-Rose <richard.townsendrose@gmail.com> - 2015-04-12 05:19 -0700
  Re: Check for a set of strings in a string - pregmatch ? if so how "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-04-12 14:59 +0200
    Re: Check for a set of strings in a string - pregmatch ? if so how Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-04-12 18:38 +0200
      Re: Check for a set of strings in a string - pregmatch ? if so how Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-12 16:32 -0400
      Re: Check for a set of strings in a string - pregmatch ? if so how "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-04-12 23:45 +0200
  Re: Check for a set of strings in a string - pregmatch ? if so how Richard Townsend-Rose <richard.townsendrose@gmail.com> - 2015-04-12 06:21 -0700
    Re: Check for a set of strings in a string - pregmatch ? if so how Richard Yates <richard@yatesguitar.com> - 2015-04-12 07:06 -0700
    Re: Check for a set of strings in a string - pregmatch ? if so how Curtis Dyer <dyer85@gmail.com> - 2015-04-30 23:17 +0000
  Re: Check for a set of strings in a string - pregmatch ? if so how Richard Townsend-Rose <richard.townsendrose@gmail.com> - 2015-04-12 08:28 -0700

csiph-web