Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking into php's max_input_vars setting

How many input variables may be accepted (limit is applied to $_GET, $_POST and $_COOKIE superglobal separately). Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request.

Basically I understand that this limits the amount of variables someone can send with POST/GET and truncates them if more are given (with warning raised).

What stays unclear is how someone can use post parameters to create

the possibility of denial of service attacks which use hash collisions

Also does it make sense to substantially decrease the number there. If for example in my application I never use more than 20 POST variables, can I change max_input_vars to say 30? If so, what improvements will I get?

If it makes a difference, I am using php 5.5.10 on apache 2.4.7

share|improve this question
1  
an example of such an hash coalition is found here arstechnica.com/civis/viewtopic.php?t=1164260 and a post content to provoke it might be this github.com/koto/blog-kotowicz-net-examples/blob/master/… –  humanityANDpeace Apr 2 at 13:11

1 Answer 1

up vote 1 down vote accepted

I might be not as good in explaining the concept of an hash collision as good as this external doc so if it becomes not clear you can have a look at it.

In principle the POST and GET data is using a key-value structure. When receiving the data in a request and when accessing $_POST then php will need to convert the list given as a string which could look like this

EzEzEzEzEzEzEzEz=&EzEzEzEzEzEzEzFY=&EzEzEzEzEzEzEzG8=&EzEzEzEzEzEzEzH%17=&EzEzEzEzEzEzFYEz=&EzEzEzEzEzEzFYFY=&EzEzEzEzEzEzFYG8=&EzEzEzEzEzEzFYH%17=&EzEzEzEzEzEzG8Ez=&EzEzEzEzEzEzG8FY=&EzEzEzEzEzEzG8G8=&

into a form so taht you can do for instance this:

echo $_POST["EzEzEzEzEzEzEzEz"];

the string is not ideal to access the value, so that internally a hash-function is used to transform it to a resulting hash value. The problem and potential attack that max_input_vars could prevent is that related to the case that two keys generate the same hash-value hence a hash_collision, which causes extra time to care for such a coallision and would allow to use up lots of CPU with a rather simple HTTP request.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.