Re: Will Sanitize-cleanArray protect against XSS attacks?
Surely someone must know a bit about XSS vulnerabilities! :) --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Cake PHP group. To post to this group, send email to cake-php@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php -~--~~~~--~~--~--~---
Re: Will Sanitize-cleanArray protect against XSS attacks?
Sorry if it sounds like I made that assumption -- I guess my question was a little too broad and the title a bit sensational. To focus my question a little further, I pointed out that in the Sanitize-html function, a simple find and replace was done on certain characters. My (very basic) understanding of XSS attacks is that they will often evade filters by using certain characters that can be expressed with patterns not caught by the filter, but when rendered, are considered the same. To say that cleanArray is the end-all solution to XSS attacks is silly, I agree :) I'm more interested in the particular issue I pointed out -- using characters not caught by the regular expression in Sanitize-html -- and whether or not such an attack would be foiled by cleanArray. My feeling is that it would not, but I don't know enough about XSS attacks to craft one that would use these other characters. Thanks for the response Sam. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Cake PHP group. To post to this group, send email to cake-php@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php -~--~~~~--~~--~--~---
Re: Will Sanitize-cleanArray protect against XSS attacks?
I can't seem to find the specific example I was looking for, but I did find this when looking back in my database for one of the tests I did: ¼script¾alert#40;¢Another Test¢#41;¼/script¾ It didn't seem to cause a problem, though I don't know if that's because of some PHP or Apache setting; my fear is that what doesn't cause a program for my local setup might cause a problem when deployed on a server that is configured differently. I could have sworn I saw the above example at... http://ha.ckers.org/xss.html ...yesterday, but I can't seem to find it now. Incidentally, the site I linked above is supposedly referenced in that OWASP site you mentioned (in the appendix). I'll have to take a look at that site as well. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Cake PHP group. To post to this group, send email to cake-php@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php -~--~~~~--~~--~--~---
Re: Will Sanitize-cleanArray protect against XSS attacks?
Just to say a bit more, I found this in the article for UTF-8 on Wikipedia: A badly-written (and not compliant with current versions of the standard) UTF-8 parser could accept a number of different pseudo-UTF-8 representations and convert them to the same Unicode output. This provides a way for information to leak past validation routines designed to process data in its eight-bit representation. http://en.wikipedia.org/wiki/UTF-8 That's the kind of thing I'm worried about, but don't really know much about. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Cake PHP group. To post to this group, send email to cake-php@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php -~--~~~~--~~--~--~---
Will Sanitize-cleanArray protect against XSS attacks?
I've been reading about all types of security vulnerabilities common in online applications, and realized that my application had some rather large XSS holes. I found that using the Sanitize function 'cleanArray' did a nice job in removing all? of the vulnerabilities, but I am curious whether it is safe to rely on cleanArray 100%. I looked at what cleanArray actually did, and noticed it called the Sanitize-html function. Looking at the contents of the html function, it seems like Sanitizes uses a simple 'find and replace' routine -- it looks for certain characters, like '' and '', then escapes them appropriately. HOWEVER, one of the hallmarks of XSS attacks is getting around simple filtering routines by using other character sets -- so for instance, if I were able to some how find a character that did not look like a '' but was interpreted as such, I don't know if cleanArray would catch it. The html function : http://api.cakephp.org/sanitize_8php-source.html#l00081 I'm hoping that someone more familiar with XSS attacks, and Cake in general, might be able to give me some insight into whether or not we can rely on cleanArray to Sanitize data that could potentially lead to XSS attacks. Would it make more sense to use something like the PHP function 'htmlentities', which allows you to specify a charset as an argument? Is it possible that Cake takes care of this problem behind the scenes? Thanks for any and all comments! --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Cake PHP group. To post to this group, send email to cake-php@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php -~--~~~~--~~--~--~---
Re: Associated Model SELECT statements
Regarding your section question, and pulling only certain
information...
Check out:
http://api.cakephp.org/class_model.html#c2d8fb14f5398c85452d978bd013436f,
which is the API page for FindAll(). One of the parameters is
'fields', where you can specify fields returned. I'm not certain, but
you might be able to specify something like:
array('ballots.*', 'options.*')
Again, I'm not sure on that, but it might help.
Also in your first question, you wrote:
$this-Ballot-Options-findAll(ballot_id=$someID); .
You could also write that as $this-Ballot-Options-findById($someID).
The result would be the same, but it looks a little better IMO.
--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups Cake
PHP group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---
Re: shared views
I did this in my application recently. I created a 'CommonController', defined actions / views for that, and redirected the user to these common pages when applicable. For instance, I had an edit function for several different models. For a success, I redirect to common/success. Seems to work, at least for what I was doing. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups Cake PHP group. To post to this group, send email to cake-php@googlegroups.com To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php -~--~~~~--~~--~--~---
