CODEWITHSUNDEEP
phpsecurity
trejder
trejder

Reputation: 17505

When PHP code should really be treated as unsafe?

Yesterday I took a part in interview for PHP developer postion. My job was to solve 15 questions quite simple test. One of the questions was to decide wether code similar to below should be treated as unsafe. I gave a wrong (as it turned out) answer and the argumentation from the other person on that interview was quite surprising (at least to me).

Code was something like that:

function someFunction($a)
{
    echo $a * 4;
}

someFunction($_GET['value']);

Possible answers were:

You could get one point for correct answer and second one for giving good explanation (argumentation) on answer chosen answer.

My answer was third: this code is never unsafe. Plus argumentation: Because, this is just a simple equation. There are no file or database operations here, no streams, protocols, no nothing. It's just an equation. Nothing else. Attacker is unable to do anything wrong with PHP script, not matter how malformed URL query he or she will try to execute. No chance.

I've got zero points. Neither my answer was correct, nor my argumentation was accepted. The correct answer was: this code is always unsafe -- you should always escape, what you got from URL query.

My question is: Is this really good point of view? Do we really have to always use a rule of thumb, that anything taken directly from query is unsafe, if not filtered, escaped or secured in any other way? Does this means, that I teach my students an unsefe coding methodologies, becuase on very first PHP lecture they write a script for calculating a triangle area and they're using unescaped, unfiltered params from URL in their task?

I understand, that security and writing safe code should be a matter of highest priority. But, on the other hand, isn't that a little bit of safe-code-fascism (forgive me, if I offended someone) to threat any code unsafe, even it no one is able to do any harm with it?

Or maybe I'm completely wrong and you can do some harm on function that echoes times four, what you gave to it?

Upvotes: 11

Views: 1271

Answers (3)

kolossus
kolossus

Reputation: 20691

NEVER trust anything that originates from a user. Just dont. Even when you cannot fathom a possibility of your code/class/package being misused, cover your own ass by ensuring the input to your product is exactly what you're expecting, no surprises. At the barest minimum, someone may supply bad input to that method just to screw with your app, to cause it to show an error or give the white screen of death. The code that does basic multiplication is a prime candidate for that kind of malevolence. It applies not just in PHP, but programming/design in general.

Upvotes: 0

Ray
Ray

Reputation: 41428

The issue is that later someone may change the function 'somefunction' and do more than simply multiply it by 4.

The function in itself is not unsafe, but the line:

 someFunction($_GET['value']);

Is completely unsafe. Maybe someFunction gets refactored into another file or is way down in the code. You should alway check and scrub user supplied data to protect yourself and others working on a library or function somewhere not caught not expecting you to pass them pure $_GET array data.

This is especially true when working with others and is why it's being asked in the interview--to see if your looking ahead at future potential issues, not to see that you understand that currently someFunction is harmless when pass possibly dangerous GET data. It's becomes an issue when your coworker refactors someFunction to query a DB table.

Upvotes: 7

SamHuckaby
SamHuckaby

Reputation: 1162

Having not spent much time playing with your code example, I won't say that it could be used to 'do harm' however, your function will not work properly unless it is passed some form of number. In the long run, it is better to escape your code, and handle erroneous data then wait for the day when an unsuspecting user puts the wrong type of value in your box and breaks things. I'm sure that the company you were interviewing for was just looking for someone with a solid habit of making sure their code is complete and unbreakable.

Upvotes: 0

Related Questions