0

In PHP server programming, URL-encoded GET/POST requests are parsed into associative "array" type upon receiving. For most of the time, query arguments can be assumed to be strings, however sometimes certain query arguments are parsed into nested arrays.

For example: 

query.php?a=123&b[]=456&b[]=789

is parsed as

[ 'a'=>"123", 'b'=>["456","789"] ]

As many functions in PHP are fault-tolerant in extremely unexpected ways, I'd like to ask the expertise of this site: is it generally acceptable to outright reject non-string queries, avoiding them as much as possible, and use query parameter prefixes instead?

Also, what are the some recommended programming practices in this regard?

Reason for asking

Recently, I saw a youtube video, where someone used a home-grown crypto scheme to verify client-controlled shell command. It used a nonce in POST argument to hmac with the command string. When the nonce is array, the hmac function verbosely succeeds and security is bypassed. It originates from a twitter image that says roughly says "this PHP code contains a deadly bug".

Update

In essence, I've wanted to ask, what are the general 'sane' patterns of query string. Since this would be too broad and mostly opinion based, it should only be included as side notes in answers.

Improve this question

1 Answer 1

Reset to default
1

You are the author of the website or otherwise server-side code — you get to decide what is a valid query string or not. Why would you concern yourself about what is acceptable? Your first responsibility is to design your API to behave as expected and be secure, not to offer « courtesy » in accepting any kind of input. Regular users are on the contrary keen to know how you defined the API, and adversaries are keen to know what you are missing.

It is perfectly acceptable, and even it is a strong requirement to validate user input, always. The video explains a problem with a bug, in that the author of the snippet did not defend against an unexpected behaviour of PHP. A string was expected and an array was passed, input was not validated, problem occurs.

Best practices always include that if you are taking input from external sources, you must validate, sanitise or otherwise verify it before doing anything with it, according to the rules you have set for your API.

P.S.: for those interested, this is the video referred to by OP: video

Improve this answer
3
  • I'll edit your answer a bit to add a bit of something of my personal interest hope you don't mind.
    – DannyNiu
    Feb 22, 2018 at 14:13
  • @DannyNiu I am glad you found my post useful, however I did not agree with your edits -- they were just not what I want to convey. I don't think there "sane" or "harmful" patterns, for the simple reason that it just depends on the endpoint you are calling. Query string arguments together must make sense for the query you are making, you don't have to refer to a catalog of common ensembles of arguments. A query string array is a perfectly valid argument if your endpoint requires it. My bottom line is simply that once you have decided on your arguments, you should aggressively validate them.
    – korrigan
    Feb 22, 2018 at 16:47
  • acknowledged, that should be in a separate question titled "avoiding antipattern in query strings".
    – DannyNiu
    Feb 23, 2018 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.