Sicherheitscheckliste für Entwickler
This document is provided as a supplement to Sicherheit für Entwickler . This is a list of common development tasks, and the security measures that need to be taken.
Sicherheitscheckliste
Wenn du mit folgenden arbeitest... | hast du... |
---|---|
Browser-Cookies |
# Attempt to fetch the UserID cookie value.
# Note: the value returned isn't trusted and is forced to be an int.
$sId = intval( $wgRequest->getCookie( 'UserID' ) );
|
Dynamic code generation |
Avoid using functions like
Sometimes you really do need these features (obviously Inline lambda functions will make it easier to make your callback inline while retaining the benefits of code that's written in native syntax instead of strings.
$str = preg_replace( "!" . preg_quote( $externalStr, '!' ) . "!", $replacement, $str );
|
Externe Programme |
// Automatically escape any naughty characters
$result = Shell::command( $cmd, '--version' )
->params( 'some', 'extra', 'parameters' )
->execute();
Note that old |
Forms |
|
GET data |
# Check if the action parameter is set to 'purge'
if ( $wgRequest->getVal( 'action' ) == 'purge' ) {
...
|
Ausgabe (API, CSS, JavaScript, HTML, XML, usw.)Any content that MediaWiki generates can be a vector for XSS attacks. |
# rawElement() escapes all attribute values
# (which, in this case, is provided by $myClass)
echo Html::rawElement( 'p', [ 'class' => $myClass ] );
|
User provided CSSUser provided CSS (Say for use in a |
# let $CSSFromUser be the user's CSS.
echo Html::rawElement( 'p', [ 'style' => Sanitizer::checkCss( $CSSFromUser ) ] );
|
POST data |
# Check if the action parameter is set to 'render'
if ( $wgRequest->getVal( 'action' ) == 'render' ) {
...
|
Query strings |
|
Sessions |
|
Reviewer anxiety |
# $wgRequest isn't yet available. Forced to use $_GET instead.
if ( $_GET['setupTestSuite'] !== null ) {
$setupTestSuiteName = $_GET['setupTestSuite'];
...
|
SQL queries |
Automated checking
Some of these issues can be checked with phan-taint-check-plugin, which is required for all MediaWiki code in Wikimedia production. This is of course just a tool, and it cannot detect all issue types, and may miss issues even in the issue types it can check for.
Siehe auch