Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently had a chat with a cracker and he told me that he can get past uri regexp checking.

I'm checking if the path_info matches my regexp and after that I match that to my routing table. If there is no routing for that path i redirect to a 404 page.

I have some little code here and I was wondering whehter someone can crack this by providing wrong data or my web app is protected? Is it possible to bypass this? (Please note that this is just some sample code):

<?php
// alphabetic characters, numbers, "-" and "/" are allowed
$pathRegex = '/[a-zA-Z0-9\/-]+/';
$pathInfo = $_SERVER["PATH_INFO"];
$routes = array(
    "homepage" => "/",
    "some_page" => "/param1/param2-something"
);

$res = preg_match($pathRegex, $pathInfo, $matches);
if ($res && $matches[0] == $pathInfo) {
    if (checkRouting($pathInfo, $routes)) {
        // keep on running
    } else {
        // 404, sorry
    }
} else {
    // wrong path
}

function checkRouting($path, $routes) {
    $res = false;
    foreach($routes as $key => $val) {
        if ($val == $path) {
            $res = true;
            break;
        }
    }
    return $res;
}
?>
share|improve this question

migrated from stackoverflow.com Jan 6 '12 at 22:18

This question came from our site for professional and enthusiast programmers.

    
Without know about the hackers approach, its scarely common to put regex as javascript/client side. Which means all regex av vulnerable. –  Independent Feb 8 '12 at 11:35

2 Answers 2

Using a regular expression creates uncertainty, makes it difficult to debug and can be resource intensive. That being said I use Regex buddy to debug regular expressions. In fact this is a tool I used to hack PHPIDS, which contains many regular expressions. The best security systems I have encountered are very simple and easy to understand, complexity is the worst enemy of security.

However what you are doing is just a simple white list to insure that $_SERVER["PATH_INFO"] is an approved path. This can be done in O(1) time complexity with a dictionary. Create a dictionary where each path is the key called $route_paths;

if(isset($route_paths[$_SERVER["PATH_INFO"]])){
    // keep on running
} else {
    // 404, sorry
}
share|improve this answer
    
I assume you're michael? :P Great PDF article though. –  phpmeh Feb 6 '12 at 3:00
    
+1 for avoiding complexity. –  CodesInChaos Feb 8 '12 at 20:46

Seems fine to me except maybe i'd do this regexp instead:

'#/([a-z0-9]+(-|/)?)*#i'
  1. It will force your url to start with /
  2. It will force your url parts to start with a letter or number
  3. It will then allow 1 - or / and then start lettering/numbering again
  4. It allows uppercase and lowercase letters all the time

I think it doesn't trash too many possibilities, anyway you can tweak it again, but the reason IMO was that he could use any number of /- at any time in the url, maybe he knew something about that.

share|improve this answer
8  
1) It won't. Starting with #^/ will. –  grawity Oct 3 '11 at 19:09
    
@grawity yep and that is how the TimThumb.php vulnerability worked. –  Rook Feb 6 '12 at 0:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.