1

This is actually a general question about template engines.

If I use Smarty-PHP to generate a website, and the templates and content are both created by me (assumed non-malicious), does this create any attack vectors against my site?

My website is static besides a lightbox plugin and has no forms, logins or other (intentional) user input mechanisms.

My theory is that because no user input is parsed, the attacker can't interact with the template engine in any way so there is no attack surface.

Is that true? I know Apache itself might be vulnerable to malicious queries, but I'm talking about the template engine specifically here. Like, is it less secure than a plain html webpage (for my use case)?

Improve this question
4
  • Where do you store the content that will populate the templates?
    – user284677
    Commented Oct 31, 2022 at 13:29
  • @Spyros it's all local on the server.
    – Drew
    Commented Nov 1, 2022 at 1:34
  • How do you put it there?
    – user284677
    Commented Nov 1, 2022 at 5:33
  • @Spyros I use SFTP
    – Drew
    Commented Nov 1, 2022 at 17:00

2 Answers 2

Reset to default
1

So, assuming that:

  • Your pages do not receive any kind of user input and templates do not use neither request parameters, nor headers
  • Your templates are being populated by content found on the server's filesystem
  • The content is put there by SFTP
  • In this question you don't care about attack vectors outside of the template engine itself (because there are other attack vectors, e.g. through SFTP or shared filesystem with malicious users)

and given that a template engine results in html, then the answer is that no, your setup is not less secure than plain html pages.

Improve this answer
2
  • Thanks, that perfectly answers my question. Quick clarification about the first bullet point. There's no code in my template or content to use either of those, does that mean it's secure, or might smarty for example react to a malicious header or url parameters, even though I myself have written no code that interprets that data?
    – Drew
    Commented Nov 1, 2022 at 17:28
  • I'm not familiar with how Smarty-PHP works, that is something that you'll need to verify. However, my experience with templates indicates that a template does not use any of these unless specifically coded to.
    – user284677
    Commented Nov 1, 2022 at 17:53
1

engine itself is not exposed to end user input, so you are OK on this one, but the other parts may be, like admin panel, file upload script, configuration file with credentials, install script, update script, any other script/CMS you may have

Improve this answer
1
  • I don't believe it's bundled with any of those, since it's not a CMS.
    – Drew
    Commented Nov 1, 2022 at 1:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .