Development

Changeset 8201

You must first sign up to be able to contribute.

Changeset 8201

Show
Ignore:
Timestamp:
04/02/08 10:19:06 (6 months ago)
Author:
fabien
Message:

removed 'bc' escaping strategy (upgrade is needed)

  • removed 'bc' escaping strategy as it gave a false sense of security (you were only secure by using $sf_data everywhere in templates!)
  • added 2 new options to the generate:app task (--escaping-strategy and --csrf-secret) to configure the level of security when creating a new application
  • default escaping strategy is now false (was bc before)
  • the sf_content variable is not escaped anymore (so the layout can now just echo $sf_content - upgrade task makes the changes for you)
  • the form_csrf_secret has been renamed to csrf_secret
  • updated the unit tests accordingly
Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/1.1/lib/config/config/core_compile.yml

    r7843 r8201  
    3636 
    3737# output escaper 
    38 - %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaper.class.php 
    39 - %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperArrayDecorator.class.php 
    40 - %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperGetterDecorator.class.php 
    41 - %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperIteratorDecorator.class.php 
    42 - %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperObjectDecorator.class.php 
     38- %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperSafe.class.php 
     39#- %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaper.class.php 
     40#- %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperArrayDecorator.class.php 
     41#- %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperGetterDecorator.class.php 
     42#- %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperIteratorDecorator.class.php 
     43#- %SF_SYMFONY_LIB_DIR%/view/escaper/sfOutputEscaperObjectDecorator.class.php 

  • branches/1.1/lib/config/config/settings.yml

    r8158 r8201  
    2525 
    2626    # Output escaping settings 
    27     escaping_strategy:      bc        # Determines how variables are made available to templates. Accepted values: bc, both, on, off. The value off deactivates escaping completely and gives a slight boost. 
     27    escaping_strategy:      off              # Determines how variables are made available to templates. Accepted values: both, on, off. The value off deactivates escaping completely and gives a slight boost. 
    2828    escaping_method:        ESC_SPECIALCHARS # Function or helper used for escaping. Accepted values: ESC_RAW, ESC_ENTITIES, ESC_JS, ESC_JS_NO_ENTITIES, and ESC_SPECIALCHARS. 
    2929 

  • branches/1.1/lib/config/sfApplicationConfiguration.class.php

    r8158 r8201  
    103103    } 
    104104 
    105     if (false !== sfConfig::get('sf_form_csrf_secret')) 
    106     { 
    107       sfForm::enableCSRFProtection(sfConfig::get('sf_form_csrf_secret')); 
     105    if (false !== sfConfig::get('sf_csrf_secret')) 
     106    { 
     107      sfForm::enableCSRFProtection(sfConfig::get('sf_csrf_secret')); 
    108108    } 
    109109 

  • branches/1.1/lib/controller/default/templates/defaultLayout.php

    r6280 r8201  
    1919<div class="sfTContainer"> 
    2020  <?php echo link_to(image_tag('/sf/sf_default/images/sfTLogo.png', array('alt' => 'symfony PHP Framework', 'class' => 'sfTLogo', 'size' => '186x39')), 'http://www.symfony-project.org/') ?> 
    21   <?php echo $this->getAttributeHolder()->isEscaped() ? $sf_data->getRaw('sf_content') : $sf_content ?> 
     21  <?php echo $sf_content ?> 
    2222</div> 
    2323</body> 

  • branches/1.1/lib/plugins/sfCompat10Plugin/test/functional/fixtures/apps/frontend/templates/layout.php

    r5320 r8201  
    1313<body> 
    1414 
    15 <?php echo $sf_data->getRaw('sf_content') ?> 
     15<?php echo $sf_content ?> 
    1616 
    1717</body> 

  • branches/1.1/lib/plugins/sfPropelPlugin/test/functional/fixtures/apps/backend/templates/layout.php

    r2217 r8201  
    1313<body> 
    1414 
    15 <?php echo $sf_data->getRaw('sf_content') ?> 
     15<?php echo $sf_content ?> 
    1616 
    1717</body> 

  • branches/1.1/lib/plugins/sfPropelPlugin/test/functional/fixtures/apps/crud/templates/layout.php

    r2126 r8201  
    1313<body> 
    1414 
    15 <?php echo $sf_data->getRaw('sf_content') ?> 
     15<?php echo $sf_content ?> 
    1616 
    1717</body> 

  • branches/1.1/lib/task/generator/sfGenerateAppTask.class.php

    r8148 r8201  
    4242    )); 
    4343 
     44    $this->addOptions(array( 
     45      new sfCommandOption('escaping-strategy', null, sfCommandOption::PARAMETER_REQUIRED, 'Output escaping strategy', false), 
     46      new sfCommandOption('csrf-secret', null, sfCommandOption::PARAMETER_REQUIRED, 'Secret to use for CSRF protection', false), 
     47    )); 
     48 
    4449    $this->aliases = array('init-app'); 
    4550    $this->namespace = 'generate'; 
    …… 
    6570If an application with the same name already exists, 
    6671it throws a [sfCommandException|COMMENT]. 
     72 
     73You can enable output escaping (to prevent XSS) by using the [escaping-strategy|COMMENT] option: 
     74 
     75  [./symfony generate:app frontend --escaping-strategy=both|INFO] 
     76 
     77You can enable session token in forms (to prevent CSRF) by defining 
     78a secret with the [csrf-secret|COMMENT] option: 
     79 
     80  [./symfony generate:app frontend --csrf-secret=Big\$ecret|INFO] 
     81 
    6782EOF; 
    6883  } 
    …… 
    96111    // Set no_script_name value in settings.yml for production environment 
    97112    $finder = sfFinder::type('file')->name('settings.yml'); 
    98     $this->getFilesystem()->replaceTokens($finder->in($appDir.'/config'), '##', '##', array('NO_SCRIPT_NAME' => ($firstApp ? 'on' : 'off'))); 
     113    $this->getFilesystem()->replaceTokens($finder->in($appDir.'/config'), '##', '##', array( 
     114      'NO_SCRIPT_NAME'    => $firstApp ? 'on' : 'off', 
     115      'CSRF_SECRET'       => sfYamlInline::dump($options['csrf-secret']), 
     116      'ESCAPING_STRATEGY' => sfYamlInline::dump($options['escaping-strategy']), 
     117    )); 
    99118 
    100119    $this->getFilesystem()->copy(dirname(__FILE__).'/skeleton/app/web/index.php', sfConfig::get('sf_web_dir').'/'.$indexName.'.php'); 

  • branches/1.1/lib/task/generator/skeleton/app/app/config/settings.yml

    r8158 r8201  
    1919    no_script_name:         off 
    2020    etag:                   off 
     21 
     22all: 
     23  .settings: 
     24    # Form security secret (CSRF protection) 
     25    csrf_secret:       ##CSRF_SECRET##     # Unique secret to enable CSRF protection or false to disable 
     26 
     27    # Output escaping settings 
     28    escaping_strategy:      ##ESCAPING_STRATEGY##            # Determines how variables are made available to templates. Accepted values: both, on, off. The value off deactivates escaping completely and gives a slight boost. 
     29    escaping_method:        ESC_SPECIALCHARS # Function or helper used for escaping. Accepted values: ESC_RAW, ESC_ENTITIES, ESC_JS, ESC_JS_NO_ENTITIES, and ESC_SPECIALCHARS. 
    2130 
    2231#all: 
    …… 
    4150#    compressed:             off       # Enable PHP response compression. Set to on to compress the outgoing HTML via the PHP handler. 
    4251#    check_lock:             off       # Enable the application lock system triggered by the clear-cache and disable tasks. Set to on to have all requests to disabled applications redirected to the $sf_symfony_data_dir/web/arrors/unavailable.php page. 
    43 # 
    44 #    # Form security secret (CSRF protection) 
    45 #    form_csrf_secret:       false     # Unique secret to enable CSRF protection or false to disable 
    46 # 
    47 #    # Output escaping settings 
    48 #    escaping_strategy:      bc        # Determines how variables are made available to templates. Accepted values: bc, both, on, off. The value off deactivates escaping completely and gives a slight boost. 
    49 #    escaping_method:        ESC_SPECIALCHARS # Function or helper used for escaping. Accepted values: ESC_RAW, ESC_ENTITIES, ESC_JS, ESC_JS_NO_ENTITIES, and ESC_SPECIALCHARS. 
    5052# 
    5153#    # Routing settings 

  • branches/1.1/lib/task/generator/skeleton/app/app/templates/layout.php

    r3278 r8201  
    1313<body> 
    1414 
    15 <?php echo $sf_data->getRaw('sf_content') ?> 
     15<?php echo $sf_content ?> 
    1616 
    1717</body> 

  • branches/1.1/lib/view/escaper/sfOutputEscaper.class.php

    r7120 r8201  
    110110        return $copy; 
    111111      } 
    112       else if ($value instanceof Traversable) 
    113       { 
    114         return new sfOutputEscaperIteratorDecorator($escapingMethod, $value); 
     112      else if (self::isClassMarkedAsSafe(get_class($value))) 
     113      { 
     114        // the class or one of its children is marked as safe 
     115        // return the unescaped object 
     116        return $value; 
    115117      } 
    116118      else if ($value instanceof sfOutputEscaperSafe) 
    …… 
    120122        return $value->getValue(); 
    121123      } 
    122       else if (self::isClassMarkedAsSafe(get_class($value))) 
    123       { 
    124         // the class or one of its children is marked as safe 
    125         // return the unescaped object 
    126         return $value; 
     124      else if ($value instanceof Traversable) 
     125      { 
     126        return new sfOutputEscaperIteratorDecorator($escapingMethod, $value); 
    127127      } 
    128128      else 

  • branches/1.1/lib/view/escaper/sfOutputEscaperSafe.class.php

    r7120 r8201  
    3232  } 
    3333 
     34  public function __toString() 
     35  { 
     36    return $this->value; 
     37  } 
     38 
    3439  /** 
    3540   * Returns the embedded value. 

  • branches/1.1/lib/view/sfEscapedViewParameterHolder.class.php

    r7899 r8201  
    3434   * <b>Options:</b> 
    3535   * 
    36    * # <b>escaping_strategy</b> - [bc]               - The escaping strategy (bc, both, on or off) 
     36   * # <b>escaping_strategy</b> - [off]              - The escaping strategy (both, on or off) 
    3737   * # <b>escaping_method</b>   - [ESC_SPECIALCHARS] - The escaping method (ESC_RAW, ESC_ENTITIES, ESC_JS, ESC_JS_NO_ENTITIES, or ESC_SPECIALCHARS) 
    3838   * 
    …… 
    4545    parent::initialize($dispatcher, $parameters, $options); 
    4646 
    47     $this->setEscaping(isset($options['escaping_strategy']) ? $options['escaping_strategy'] : 'bc'); 
     47    $this->setEscaping(isset($options['escaping_strategy']) ? $options['escaping_strategy'] : false); 
    4848    $this->setEscapingMethod(isset($options['escaping_method']) ? $options['escaping_method'] : 'ESC_SPECIALCHARS'); 
    4949  } 
    …… 
    7070    $attributes = array(); 
    7171 
    72     switch ($this->getEscaping()) 
     72    switch (true) 
    7373    { 
    74       case 'on': 
    75         $attributes['sf_data'] = sfOutputEscaper::escape($this->getEscapingMethod(), $this->getAll()); 
    76         break; 
    77       case 'bc': 
    78         $attributes = $this->getAll(); 
    79         $attributes['sf_data'] = sfOutputEscaper::escape($this->getEscapingMethod(), $this->getAll()); 
    80         break; 
    81       case 'both': 
     74      case 'bc' === $this->getEscaping(): 
     75        throw new InvalidArgumentException(sprintf('Escaping strategy "bc" is deprecated.')); 
     76      case 'both' === $this->getEscaping(): 
    8277        $attributes['sf_data'] = sfOutputEscaper::escape($this->getEscapingMethod(), $this->getAll()); 
    8378        foreach ($attributes['sf_data'] as $key => $value) 
    …… 
    8681        } 
    8782        break; 
    88       case 'off': 
     83      case 'off' === $this->getEscaping(): 
     84      case false === $this->getEscaping(): 
    8985        $attributes = $this->getAll(); 
     86        break; 
     87      case 'on' === $this->getEscaping(): 
     88      case true === $this->getEscaping(): 
     89        $attributes['sf_data'] = sfOutputEscaper::escape($this->getEscapingMethod(), $this->getAll()); 
    9090        break; 
    9191      default: 

  • branches/1.1/lib/view/sfPHPView.class.php

    r8138 r8201  
    128128    $attributeHolder = $this->attributeHolder; 
    129129 
    130     $this->attributeHolder = $this->initializeAttributeHolder(array('sf_content' => $content)); 
     130    $this->attributeHolder = $this->initializeAttributeHolder(array('sf_content' => new sfOutputEscaperSafe($content))); 
    131131 
    132132    // render the decorator template and return the result 

  • branches/1.1/test/functional/escapingTest.php

    r6723 r8201  
    3636 
    3737$b-> 
    38   get('/escaping/bc')-> 
    39   isStatusCode(200)-> 
    40   isRequestParameter('module', 'escaping')-> 
    41   isRequestParameter('action', 'bc')-> 
    42   responseContains('<h1>Lorem <strong>ipsum</strong> dolor sit amet.</h1>')-> 
    43   responseContains('<h2>Lorem &lt;strong&gt;ipsum&lt;/strong&gt; dolor sit amet.</h2>'); 
    44 ; 
    45  
    46 $b-> 
    4738  get('/escaping/off')-> 
    4839  isStatusCode(200)-> 

  • branches/1.1/test/functional/fixtures/project/apps/cache/templates/image.php

    r3098 r8201  
    1 <?php echo $sf_data->getRaw('sf_content') ?> 
     1<?php echo $sf_content ?> 

  • branches/1.1/test/functional/fixtures/project/apps/cache/templates/layout.php

    r7729 r8201  
    1313<body> 
    1414 
    15 <?php echo $sf_data->getRaw('sf_content') ?> 
     15<?php echo $sf_content ?> 
    1616 
    1717<div id="component_slot_content"><?php echo get_slot('component') ?></div> 

  • branches/1.1/test/functional/fixtures/project/apps/frontend/modules/escaping/actions/actions.class.php

    r6723 r8201  
    2828  } 
    2929 
    30   public function executeBc() 
    31   { 
    32     sfConfig::set('sf_escaping_strategy', 'bc'); 
    33   } 
    34  
    3530  public function executeOff() 
    3631  { 

  • branches/1.1/test/functional/fixtures/project/apps/frontend/templates/layout.php

    r2069 r8201  
    1313<body> 
    1414 
    15 <?php echo $sf_data->getRaw('sf_content') ?> 
     15<?php echo $sf_content ?> 
    1616 
    1717</body> 

  • branches/1.1/test/functional/fixtures/project/apps/i18n/templates/layout.php

    r2740 r8201  
    1313<body> 
    1414 
    15 <?php echo $sf_data->getRaw('sf_content') ?> 
     15<?php echo $sf_content ?> 
    1616 
    1717</body> 

  • branches/1.1/test/unit/view/sfEscapedViewParameterHolderTest.php

    r7899 r8201  
    1212require_once($_test_dir.'/unit/sfContextMock.class.php'); 
    1313 
    14 $t = new lime_test(27, new lime_output_color()); 
     14$t = new lime_test(23, new lime_output_color()); 
    1515 
    1616define('ESC_SPECIALCHARS', 'esc_specialchars'); 
    …… 
    126126} 
    127127 
    128 $t->diag('Escaping strategy to bc'); 
    129 $p->setEscaping('bc'); 
    130 $values = $p->toArray(); 
    131 $t->is(count($values), 2, '->toArray() knows about the "bc" strategy'); 
    132 $t->is(count($values['sf_data']), 1, '->toArray() knows about the "bc" strategy'); 
    133 $t->is($values['foo'], 'bar', '->toArray() knows about the "bc" strategy'); 
    134 $t->is($values['sf_data']['foo'], '-ESCAPED-bar-ESCAPED-', '->toArray() knows about the "bc" strategy'); 
    135  
    136128$t->diag('Escaping strategy to both'); 
    137129$p->setEscaping('both');