Register Members List Search Today's Posts Mark Forums Read

Reply
 
Article Options
Create Secure Mods
Adrian Schneider
Join Date: Jul 2004
Posts: 2,528

by Adrian Schneider Adrian Schneider is offline 06 Aug 2007

In this post we'll go over some basic modification vulnerabilities and how to prevent them.

Preparing Data

Whenever you accept input from a user, you must understand that you have no control over what is entered, period. The short version is that anything client-side can be manipulated. Even if you use Javascript or HTML limitations, they can all easily be avoided. This input includes but is not limited to:
  • Entered form input
  • Hidden form input (!)
  • URL query string
  • User Agent
In your application it is your responsibility to ensure the validity of the data they enter.

Use the vBulletin Input Cleaner!

I'm going to assume you know how to use it, even though sometimes you choose not to use it. If not, dig up a tutorial on it.

A common example is fetching a row from a table using an ID in the query string. I often see this:
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Not good.

Here is what you should use...
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

The TYPE_UINT ensures that the variable is an integer, and is >= 0. You can also use $id in the rest of your application, more confidently. But wait... if they don't enter a valid integer here, it will just be 0! We can prevent that query from running in this case. Though no harm would be done, it is good to do as little processing as possible to keep things running fast.


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

That's better. The same concept applies to a lot of different types of data. If you expect them to enter an email address, then you can use the is_valid_email() function. If you expect them to enter one of a few specific answers, have those answers in an array and ensure that it matches. Example,
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

If you expect them to enter data in a certain pattern - for example, a md5 hash, then you can use a regular expression to match it.
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Not a great example, but you should really learn to use regular expressions to match the validity of data. An EXCELLENT tool to have. If you use the vBulletin datamanager for your custom application, be sure to use the error checking functionality in it. Very flexible.

Point: ensure the data you expect is what you expect. If it's not, do not let them continue. False data can do a number of things of varying damage:
  • Display a PHP error. Not a big deal, but it may disclose your script names and path. The less information they know about it the better.
  • Display SQL error. Injection, anyone?
  • Get into DB . It looks horrible to visitors when they see random junk on your website. Ohter side effects include: breaking search capabilities, false statistics, even DB errors down the road! Injection round two!
SQL Injection

What is SQL injection? It's when your script does not properly clean user input, and they can actually manipulate the query using the input value.

Example,

A script to update a user's email address. Here is the query:
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

You'd expect the user to enter an email address, but what if they don't? If the value they enter contains a single quote, it will end the string email value in the query, and it will be parsed as SQL. This is injection. What could happen from this? It really depends on the query, but it can be devastating. If I enter
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

The final query is:
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Since a # is a MySQL comment starter (one of the few ways), here is the query:
Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

This affects the query in two ways:
  • Adds two new columns and values into the query
  • Removes the WHERE clause
In English - wiped out your entire user table.

Preventing Injection

It is very easy to prevent injection. Generally, users either input text (string) or a number (int/float). For the latter, they should already be safe assuming you used the input cleaner as suggested. For strings, however, you must use the $db->escape_string() function. What does this do? In a standard MySQL setup, it's just a wrapper for mysql_real_escape_string which in simpliest terms, prepends a backslash to any characters which may alter query. Remember to use $db->escape_string() instead of the actual function, because not every board runs MySQL!

Automation

I highly recommend using a function to generate queries. This is how the datamanager works, and also many of my own private hacks. How does this make it more secure? - by not relying on the coder to escape it. If you do so, you can wrap each value in the $db->sql_prepare() function, which makes it SQL safe.

Here is what the function does to...
  • Strings, returns it escaped, and wrapped in single quotes
  • Numbers, returns them as is
  • Booleans, returns them in their integer form (1 and 0)
  • Anything else, returns it escaped, and wrapped in single quotes
Very useful tool.



XSS (Cross Site Scripting)

Cross site scripting is when a user injects HTML into any text that he posts, and in that HTML uses Javascript to communicate with his own server. What can this do? He can steal your cookie information and take over your online identity. Imagine someone doing this to an administrative account. Uh oh!

Like SQL injection, XSS is actually very easy to prevent. You have two options:

1)
Use TYPE_NOHTML instead of TYPE_STR when accepting string input.This has a few (minor) downsides. If you want to allow searching, or for any other reason want to retain the exact information the user enters. The alternative, is

2)
Clean it using htmlspecialchars_uni() when displaying the text. This is where it gets tricky. If you display it all over the place, it can be difficult to remember to clean it every time.

So what does this do exactly? Any HTML characters, such as "<", ">", and "&" are parsed as HTML, so if you convert them to their entity form ("&lt;", "&gt;", "&amp;", the browser knows to display that character, and not parse it as HTML. Now it is impossible for any hackers to inject HTML into your site.


Summary
  • Only accept input that is what you expect.
  • Escape strings when using them inside queries.
  • Convert all HTML characters to entities before displaying them.
If you have any further questions, you may contact me at vBlogetin.com, or at SirAdrian.com


You may not copy this article without my permission.

Last edited by Adrian Schneider; 24 Aug 2007 at 07:19..
Views: 12610
Reply With Quote
Comments
  #2  
Old 06 Aug 2007, 14:45
EnIgMa1234 EnIgMa1234 is offline
 
Join Date: Mar 2006
Real name: David
Excellant article. Very very helpful. Great job Sir Adrian
Reply With Quote
  #3  
Old 06 Aug 2007, 15:03
Atakan KOC's Avatar
Atakan KOC Atakan KOC is offline
 
Join Date: Feb 2006
Real name: Atakan KOÇ
Good Articles. Thanks Sir Adrian.
__________________
vBulletin 5 : http://www.atabb.com/
Reply With Quote
  #4  
Old 06 Aug 2007, 15:23
D&Y's Avatar
D&Y D&Y is offline
 
Join Date: Jun 2005
Very Nice Article..

Thanks !
Reply With Quote
  #5  
Old 06 Aug 2007, 16:20
Blaine0002's Avatar
Blaine0002 Blaine0002 is offline
 
Join Date: Jul 2003
Thank you for this!
Reply With Quote
  #6  
Old 07 Aug 2007, 10:13
kaptanblack's Avatar
kaptanblack kaptanblack is offline
 
Join Date: Mar 2007
Nice article SirAdrian

Thanks...
Reply With Quote
  #7  
Old 07 Aug 2007, 15:20
Princeton's Avatar
Princeton Princeton is offline
 
Join Date: Nov 2001
Real name: Joe Velez
superb article SirAdrian

A hghly recommended must read article.
__________________
Former vBulletin.org Staff Member

Latest Articles:
Liquid Layout = Less Ad Revenue?
How to Monetize Your Site
Improve Web Page Performance
How To Write For The Web


If it needs instructions, there's room for improvement.
Give users what they actually want, not what they say they want. And whatever you do, don't give them new features just because your competitors have them!
Reply With Quote
  #8  
Old 07 Aug 2007, 15:29
bobster65's Avatar
bobster65 bobster65 is offline
 
Join Date: Mar 2006
Real name: Bob
Originally Posted by Princeton View Post
superb article SirAdrian

A hghly recommended must read article.
Couldn't have said it better Princeton!

Thank you SirAdrian
Reply With Quote
  #9  
Old 07 Aug 2007, 16:16
mihai11 mihai11 is offline
 
Join Date: Dec 2005
Great article ! Exactly what I was asking in another thread !
Reply With Quote
  #10  
Old 07 Aug 2007, 16:26
Andreas's Avatar
Andreas Andreas is offline
 
Join Date: Jan 2004
Real name: Andreas
Addition: Use fetch_query_sql() whenever it makes sense.
Reply With Quote
  #11  
Old 07 Aug 2007, 16:33
mihai11 mihai11 is offline
 
Join Date: Dec 2005
Originally Posted by Andreas View Post
Addition: Use fetch_query_sql() whenever it makes sense.
This looks like a function for reading from the database. I assume that once the data is there, it can be trusted. Does this function has any security implications ? (after all, this is the theme of this article)
Reply With Quote
  #12  
Old 07 Aug 2007, 16:41
Andreas's Avatar
Andreas Andreas is offline
 
Join Date: Jan 2004
Real name: Andreas
I assume that once the data is there, it can be trusted.
Wrong assumption.

Example: A post that contains
<script type="text/javascript">
alert('XSS!');
</script>
Now, if you parse this text or run htmlspecialchars_uni() on it you are safe.
However, if you just read pagetext from table post and output it, then you just created an XSS issue.

Originally Posted by vBulletin functions.php

Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.
As you can see, it runs escape_string() automatically
Reply With Quote
  #13  
Old 08 Aug 2007, 02:20
Adrian Schneider's Avatar
Adrian Schneider Adrian Schneider is offline
 
Join Date: Jul 2004
fetch_query_sql() was what I meant by automation, thouh I actually use my own function that combines the $db->query_write() call and the fetch_query_sql.

Thanks for pointing that out - I'll add it in later.
Reply With Quote
  #14  
Old 08 Aug 2007, 04:02
mihai11 mihai11 is offline
 
Join Date: Dec 2005
Originally Posted by Andreas View Post
Wrong assumption.

Example: A post that contains

Now, if you parse this text or run htmlspecialchars_uni() on it you are safe.
However, if you just read pagetext from table post and output it, then you just created an XSS issue.


As you can see, it runs escape_string() automatically
But you should escape data *before* entering the database. You should make sure that whatever enters the database is clean. The reason is that usually the data is put into the database once and read many times thus it is better to do all validations when putting the data into the database and not when reading it.
Reply With Quote
  #15  
Old 08 Aug 2007, 04:14
Adrian Schneider's Avatar
Adrian Schneider Adrian Schneider is offline
 
Join Date: Jul 2004
XSS and SQL injection are two different vulnerabilities.

Escaping it will avoid injection, but the XSS threat still remains unless you TYPE_NOHTML or htmlspecialchars_uni() before displaying it.
Reply With Quote
Reply

Similar Article
Article Author Type Replies Last Post
Major Additions vbFEngine Create your own Mods by vbFreelancers Olympic Modification Graveyard 65 10 Mar 2008 13:36



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Article Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 17:57.

Layout Options | Width: Wide Color: