New answers tagged owasp-top-ten
I'm the author of the OWASP page about PHP Object Injection. Like already said by Guilherme Sehn, json_decode will not allow for object deserialization, and the snippet code you've posted contains a vulnerability which doesn't concern PHP Object Injection. So, I think it's correct to say that using JSON functions is enough to prevent object injection ...
Unlike unserialize, if you execute json_decode alone it will not be able to instantiate any different variable types besides simple ones (e.g. arrays, string, int, float, etc), so it is fairly safe to run it with user input data. The problem in your code is with the e function. If the parameters you pass to it come from an untrusted source such as user ...
fix for what? serialized objects might be usefull, but you should just never ever unserialze() user-input; this WILL fail and there WILL be a smarter guy that will find this vuln. the OWASP-page is very wrong (IMHO): it just should issue a BIG RED WARNING: DONT USE UNSERIALIZE ON USER DATA or am i wrong here?
Top 50 recent answers are included