#18727 [Com]: XSS in I/O Function Output

ID: 18727 Comment by: msopacua@idg.nl Reported By: mattmurphy@kc.rr.com Status: Open Bug Type: Output Control Operating System: Win32 PHP Version: 4.2.2 New Comment: So, this 'security issue' occurs when: 1) Errors are spit to the browser instead of a log, like it is, before you put it in production, right? 2) fopen is called, on a non-existing file (see: file_exists), directly accepting user input - ahum. Additionally - the 'vulnerability' has got nothing to do with PHP, but everything with browsers and JavaScript. Previous Comments: ------------------------------------------------------------------------ [2002-08-03 16:23:31] mattmurphy@kc.rr.com Didn't change the status... :-) ------------------------------------------------------------------------ [2002-08-03 16:22:36] mattmurphy@kc.rr.com Now, you tell me how a programmer could prevent this attack. If he HTML-encoded his file name before using it, it would screw up his script's function. The problem is *not* in the script, but in PHP's fopen() function. A simple HTML encode (e.g, instead of "<SCRIPT>", "&lt;SCRIPT&gt;") would do the job of avoiding the bug, AND would not change the appearence of the output. The current situation is at best unsafe. ------------------------------------------------------------------------ [2002-08-03 16:17:19] cynic@php.net it's the programmer's responsibility to prevent such attacks. i for one surely wouldn't want php muck with the error output while writing some quick scripts. in larger applications, you need custom error handler and/or display_errors = off anyway. so what's the deal? ------------------------------------------------------------------------ [2002-08-03 16:11:01] mattmurphy@kc.rr.com Once again, I'm astounded by the overwhelmingly negative message that the PHP Group sends users of PHP sites -- thanks to us, somebody can steal your personal information! Oh, and, thanks for your business. That is at least counter-productive, yes? ------------------------------------------------------------------------ [2002-08-03 16:00:54] sander@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/18727 -- Edit this bug report at http://bugs.php.net/?id=18727&edit=1