4 ms·

How? I'm evaluating strings that are built with my javascript code or from my server code, not arbitrary user input from other users. Yes the user is able to en

How? I'm evaluating strings that are built with my javascript code or from my server code, not arbitrary user input from other users. Yes the user is able to enter parenthesis into a textbox, and those become part of the evaluated string, but I regex replace out everything but the actual parenthesis.

giardini 17y ago
Rather than "regex replace out" problematic elements, you should immediately toss the data back to the user for correction. Trying to "correct" a potential hacker's string is often a losing proposition.
tptacek 17y ago
Every security assessor's favorite answer to a threat: "but I regex out everything unsafe".
- euroclydon 17y ago
  How is building an intermediate portion of a nested logical statement, using eval() dangerous? Here is the regex for what I allow (only '[' & ']'): value.replace(/[^(]/g, '').replace(/\(/g, '[') value.replace(/[^)]/g, '').replace(/\)/g, '],') I guess the point you all are trying to make is that some javascript text could have been maliciously inserted into the page somehow, and accidentally get eval'd simply because eval is in use, but the page below says that one of the only times eval should be used is to build up complex mathematical expressions. Is there a safe way to build up such expressions? Send it to the server, and invoke a JS engine there? The reason I made my original comment was because I found the eval function to be so helpful in this scenario, b/c I didn't need to use any type of syntax parsing. http://blogs.msdn.com/ericlippert/archive/2003/11/01/53329.aspx http://blogs.msdn.com/ericlippert/archive/2003/11/01/53329.a...
  - tptacek 17y ago
    If you are confident about charsets and you whitelist down to known-good characters ([A-Za-z0-9_ \t]) I have nothing snarky to say about the design. Otherwise, try reading this very short thread: http://www.webappsec.org/lists/websecurity/archive/2010-03/msg00044.html http://www.webappsec.org/lists/websecurity/archive/2010-03/m... (It's not exactly your problem but you'll get the flavor.)
stcredzero 17y ago
Yes, but the security of that part of your system could be pretty implicit, hence less than robust in the face of maintenance coding. The idea that "this is safe because everything but the parens are filtered out" won't necessarily jump out of the code at whoever maintains it. If the code is structured to reveal this intention explicitly, then job well done. (Note: It's not always a good idea to rest the future security of your system on a comment in the code!)

giardini 17y ago

Rather than "regex replace out" problematic elements, you should immediately toss the data back to the user for correction. Trying to "correct" a potential hacker's string is often a losing proposition.

tptacek 17y ago

Every security assessor's favorite answer to a threat: "but I regex out everything unsafe".

euroclydon 17y ago
How is building an intermediate portion of a nested logical statement, using eval() dangerous? Here is the regex for what I allow (only '[' & ']'): value.replace(/[^(]/g, '').replace(/\(/g, '[') value.replace(/[^)]/g, '').replace(/\)/g, '],') I guess the point you all are trying to make is that some javascript text could have been maliciously inserted into the page somehow, and accidentally get eval'd simply because eval is in use, but the page below says that one of the only times eval should be used is to build up complex mathematical expressions. Is there a safe way to build up such expressions? Send it to the server, and invoke a JS engine there? The reason I made my original comment was because I found the eval function to be so helpful in this scenario, b/c I didn't need to use any type of syntax parsing. http://blogs.msdn.com/ericlippert/archive/2003/11/01/53329.aspx http://blogs.msdn.com/ericlippert/archive/2003/11/01/53329.a...
- tptacek 17y ago
  If you are confident about charsets and you whitelist down to known-good characters ([A-Za-z0-9_ \t]) I have nothing snarky to say about the design. Otherwise, try reading this very short thread: http://www.webappsec.org/lists/websecurity/archive/2010-03/msg00044.html http://www.webappsec.org/lists/websecurity/archive/2010-03/m... (It's not exactly your problem but you'll get the flavor.)

stcredzero 17y ago

Yes, but the security of that part of your system could be pretty implicit, hence less than robust in the face of maintenance coding. The idea that "this is safe because everything but the parens are filtered out" won't necessarily jump out of the code at whoever maintains it. If the code is structured to reveal this intention explicitly, then job well done. (Note: It's not always a good idea to rest the future security of your system on a comment in the code!)