I want to know if is bad to trust the PHP's global variable $_SERVER values.

I have a scenario that I change between developer and production site, and I have a config.php file. On this file, I check $_SERVER['SERVER_NAME'] value, to determine which group of constants I should use. If I'm on production environment I use a list A of constants, if I'm on developer environment I use another list of constants.

Does this make my PHP project vulnerable in any way?

  • 2
    To answer more broadly: some elements in the $_SERVER variable are user-provided, and some are not. Don't trust the ones that are user provided. – Conor Mancone Nov 13 '20 at 20:23
  • 2
    See stackoverflow.com/questions/6474783/… – mti2935 Nov 13 '20 at 21:55
  • @ConorMancone if I limit the acceptable values that comes from a user-provided data, like using a array that keeps a white list of valid domains, the project still vulnerable? – churros Nov 14 '20 at 18:00

A: yes... from the perspective of the trailing question, "Does this make my PHP project vulnerable in any way?"

I'll assume that in the config file you have salt/pepper, database credentials, and other parameters that you might find in an ownCloud or Wordpress config.php file, the sort of which would hold value for an adversary.

If your config.php is exposed in your lower environment, you are making production-environment configuration parameters available in this file. Just about anything can happen in a dev environment, where as hopefully your production environment is a little more locked down. The potential for exposure is greater by having all the configuration parameters in the one file.

And for the rigid interpretation of your question... A: no

Your config.php file would not in any way be less safe if you had an if/else or other branching conditional and the logic was correct. The potential for the contents of this file to be exposed under normal php and web server operation is no different than if you had separate files per environment. With respect to safe, see the other answer that @mti2935 linked to (in a comments against this question) that discusses the safety of the variables in the $_SERVER dict, ie. which parameters can be influenced by the user.

Another observation - with a branching conditional, you're relying on correct implementation of the web server and php interpreter to prevent the user influencing the contents of the $_SERVER dict. I don't have time at the moment to find an example, but there's a large number of vulnerability records to wade through: https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=%24_SERVER&queryType=phrase&search_type=last3years

  • 2
    I think the question was more about using $_SERVER variables. – multithr3at3d Nov 14 '20 at 15:21
  • Hi, @brynk.. I considered that. But I'm trying to understand how this config file could turn things bad on my project. The file doesn't print out anything, i'ts just a list of constants inside a if/else block that checks $_SERVER['name'] value. Before that, on the beginning of the script, I have a domain check that kills the script if the request comes from a not allowed URL. Even with that check, the project still vulnerable? Why? – churros Nov 14 '20 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.