3 ms·
you mean you shouldn't trust user input?
by jumby 14y ago
you mean you shouldn't trust user input?
- renownedmedia 14y agoThe arguments to controller methods (in CI) are passed through some regular expressions. CI goes as far as to destroy all GET variables (which I highly disagree with).
- mmmooo 14y agoGET's are all removed (by default), but for uri segments you'll just get some character filters, and some anti-xss attempts (assuming you have that on). Nothing anywhere near sufficient to prevent sql injection. Again, didn't dig too deep, but I don't see any validation that would prevent me from doing some level of at least blindsql..
- rokhayakebe 14y agoI think CI rejects anything in the URI which isn't alpha-numeric. Would that solve the issue?
- mmmooo 14y agoKind of, anything in permited_uri_chars is allowed. This includes spaces, slashes, commas, %, and a handful of others by default. As I said only skimmed quickly so maybe I'm missing it. Will take a deeper look in a bit once not on mobile.
- renownedmedia 14y agoThis is the escaping mechanism I was using.
- renownedmedia 14y agoI would be excited to see an example exploit executed against the app, I've tried plenty of times without success. Any pull request to fix a vulnerability will be happily accepted!
- mmmooo 14y agoI live by the communist motto. Trust, but verify.