Proposed PHP function: is_literal()

A way to identify trusted developer strings (aka "literals", which have been defined within the PHP script) which need to be used for HTML templates, SQL strings, CLI strings; and keep those completely separate from user controlled (attacker tainted) strings.

Transcript

1. is_literal() A proposed function for PHP Craig Francis
2. is_literal() To distinguish between safe strings, which have been de fi ned in your PHP script.
3. is_literal() To distinguish between safe strings, which have been de fi ned in your PHP script. VS unsafe strings, which have been tainted by external sources.
4. The Problem
5. The Problem
6. The Problem
7. The Problem Version 5.4. 1 April 29, 2020
8. The Problem Version 5.4. 2 June 10, 2020
9. Google engineer Christoph Kern, 2015: https://www.usenix.org/conference/usenixsecurity15/symposium-program/ presentation/kern Background
10. Google engineer Christoph Kern, 2015: "Developer education doesn't solve the problem" Background
11. Google engineer Christoph Kern, 2015: "Bugs are hard to fi nd after the fact" Background
12. Google engineer Christoph Kern, 2015: "Bugs are hard to fi nd after the fact" "Manual Testing, Automated Testing, Static Analysis, Human Code Reviews; ... will fi nd some of these bugs..." @04:02 Background
13. Examples
14. Examples
15. Examples
16. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = 1') ->getQuery() ->getResult(); Doctrine QueryBuilder Examples
17. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = ?1') ->setParameter(1, $_GET['type_id']) ->getQuery() ->getResult(); Examples
18. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = 1') ->getQuery() ->getResult(); Examples
19. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = ' . $_GET['type_id']) ->getQuery() ->getResult(); Examples
20. Examples
21. Examples
22. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = 1') ->getQuery() ->getResult(); Safe String, a Literal Examples
23. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = ' . $_GET['type_id']) ->getQuery() ->getResult(); Unsafe String Safe String Examples
24. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = ' . $_GET['type_id']) ->getQuery() ->getResult(); Examples 'WHERE u.type_id = u.type_id'
25. $sql = 'SELECT u FROM User u WHERE u.type_id = ' . $_GET['type_id']; $query = $entityManager->createQuery($sql); Doctrine - CreateQuery, DQL Examples
26. $users = UserQuery::create()->where('type_id = ' . $_GET['type_id'])-> fi nd(); Propel ORM - Where Examples
27. $result = R:: fi nd('user', 'type_id = ' . $_GET['type_id']); RedBeanPHP - Find Examples
28. $template = $twig->createTemplate('<p>Hello {{ name }}</p>'); echo $template->render(['name' => $_GET['name']]); Examples Safe String, a Literal
29. $template = $twig->createTemplate('<p>Hello ' . $_GET['name'] . '</p>'); echo $template->render(); Examples Unsafe String
30. Examples
31. $output = shell_exec('ls /'); Safe String, a Literal Examples
32. Examples $output = shell_exec('ls ' . $_GET['path']); Unsafe String
33. Taint Checking https://pecl.php.net/package/taint
34. Taint Checking $pre fi x = 'Hi '; $welcome_html = $pre fi x . 'Name';
35. Taint Checking $pre fi x = 'Hi '; $welcome_html = $pre fi x . 'Name'; Untainted
36. Taint Checking $pre fi x = 'Hi '; $welcome_html = $pre fi x . 'Name'; Untainted Untainted Untainted
37. Taint Checking $pre fi x = 'Hi '; $welcome_html = $pre fi x . 'Name'; Untainted, Safe
38. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . $name;
39. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . $name; Tainted
40. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . $name;
41. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . $name; Untainted
42. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . $name; Untainted Tainted
43. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . $name; Tainted, not safe... complain when printed.
44. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . htmlentities($name);
45. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . htmlentities($name); Un-Taint
46. Taint Checking $name = $_GET['name']; $pre fi x = 'Hi '; $welcome_html = $pre fi x . htmlentities($name); Untainted, should be safe.
47. Taint Checking $url = $_GET['url']; $name = $_GET['name']; $link_html = '<a href="' . htmlentities($url) . '">' . htmlentities($name) . '</a>';
48. Taint Checking $url = $_GET['url']; $name = $_GET['name']; $link_html = '<a href="' . htmlentities($url) . '">' . htmlentities($name) . '</a>'; Tainted Tainted
49. Taint Checking $url = $_GET['url']; $name = $_GET['name']; $link_html = '<a href="' . htmlentities($url) . '">' . htmlentities($name) . '</a>'; Tainted Tainted
50. Taint Checking $url = $_GET['url']; $name = $_GET['name']; $link_html = '<a href="' . htmlentities($url) . '">' . htmlentities($name) . '</a>'; Un-Taint Un-Taint
51. Taint Checking $url = $_GET['url']; $name = $_GET['name']; $link_html = '<a href="' . htmlentities($url) . '">' . htmlentities($name) . '</a>'; Untainted, surely this is safe?
52. Taint Checking $url = $_GET['url']; $name = $_GET['name']; $link_html = '<a href="' . htmlentities($url) . '">' . htmlentities($name) . '</a>'; 'javascript:alert("hi")'
53. Taint Checking $sql .= 'WHERE id = ' . mysqli_real_escape_string($link, $_GET['id']); Tainted
54. Taint Checking $sql .= 'WHERE id = ' . mysqli_real_escape_string($link, $_GET['id']); Untainted Un-Taint
55. Untainted, surely this is safe? Taint Checking $sql .= 'WHERE id = ' . mysqli_real_escape_string($link, $_GET['id']);
56. Taint Checking $sql .= 'WHERE id = ' . mysqli_real_escape_string($link, $_GET['id']); Missing quotes
57. Taint Checking $sql .= 'WHERE id = ' . mysqli_real_escape_string($link, $_GET['id']); "id"
58. Taint Checking $sql .= 'WHERE id = ' . mysqli_real_escape_string($link, $_GET['id']); $sql .= 'WHERE id = id'; "id"
59. Taint Checking $img_html = '<img src=' . htmlentities($_GET['url']) . '>'; Tainted Untainted Untainted
60. Taint Checking $img_html = '<img src=' . htmlentities($_GET['url']) . '>'; Un-Taint
61. Taint Checking $img_html = '<img src=' . htmlentities($_GET['url']) . '>'; Untainted, surely this is safe?
62. Taint Checking $img_html = '<img src=' . htmlentities($_GET['url']) . '>'; Missing quotes
63. Taint Checking $img_html = '<img src=' . htmlentities($_GET['url']) . '>'; $img_html = '<img src=/ onerror=evil-js>'; "/ onerror=evil-js"
64. Taint Checking How about character encoding issues?
65. Taint Checking The PDO Quote function clearly says it's only "theoretically safe". https://www.php.net/pdo.quote
66. Static Analysis
67. Injection problems are rarely solved by Static Analysis. Static Analysis
68. Injection problems are rarely solved by Static Analysis. Still do use this. Static Analysis
69. Injection problems are rarely solved by Static Analysis. Static Analysis But it's hard to follow every variable from Source to Sink.
70. Injection problems are rarely solved by Static Analysis. Static Analysis And don't expect every programmer to use.
71. $mysqli = new mysqli('localhost', 'test', '???', 'test'); $result = $mysqli->query('SELECT * FROM user WHERE id = ' . $_GET['id']); if ($result instanceof mysqli_result) { print_r($result->fetch_all()); } Static Analysis PHPStan
72. $mysqli = new mysqli('localhost', 'test', '???', 'test'); $id = (string) $_GET['id']; $result = $mysqli->query('SELECT * FROM user WHERE id = ' . $id); if ($result instanceof mysqli_result) { print_r($result->fetch_all()); } Static Analysis Avoid MixedAssignment Psalm
73. $mysqli = new mysqli('localhost', 'test', '???', 'test'); $id = (string) $_GET['id']; $result = $mysqli->query('SELECT * FROM user WHERE id = ' . $id); if ($result instanceof mysqli_result) { print_r($result->fetch_all()); } Static Analysis Psalm, Taint Analysis I'm not using "mysqli_query()" https://github.com/vimeo/psalm/issues/4155 Avoid MixedAssignment
74. Summary Do not mix safe strings (literals), with anything that may be attacker controlled.
75. Summary We need a way to ensure this does not happen.
76. is_literal('This is a Literal');
77. is_literal('This is a Literal'); true
78. $a = 'This is a Literal'; is_literal($a); true
79. $a = 'This is a Literal'; is_literal($a . 'And this'); true
80. $a = 'This is a Literal'; is_literal($a . $_GET['name']); false
81. $a = 'This is a Literal'; is_literal($a . htmlentities($_GET['name'])); Still false
82. $a = 'This is a Literal'; is_literal($a . htmlentities($_GET['name'])); Still false is_literal() is not the same as Taint Checking.
83. $a = 'This is a Literal'; is_literal($a . strtoupper('abc')); Sorry, this is false - 'ABC' is no longer the string de fi ned in the PHP script.
84. $sql .= ' AND id = "' . mysqli_real_escape_string($db, $_GET['id']) . '"'; is_literal($sql); Still false
85. $sql .= ' AND id = ?'; $parameters[] = $_GET['id']; is_literal($sql); true
86. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = 1') ->getQuery() ->getResult(); Doctrine
87. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = 1') ->getQuery() ->getResult(); public function where($predicates) { if (!is_literal($predicates)) { throw new Exception('Can only accept a literal'); } ... } Is a Safe Literal?
88. $users = $queryBuilder ->select('u') ->from('User', 'u') ->where('u.type_id = ' . $_GET['type_id']) ->getQuery() ->getResult(); public function where($predicates) { if (!is_literal($predicates)) { throw new Exception('Can only accept a literal'); } ... } Not a Safe Literal
89. $template = $twig->createTemplate('<p>Hello {{ name }}</p>'); echo $template->render(['name' => $_GET['name']]); Twig
90. $template = $twig->createTemplate('<p>Hello {{ name }}</p>'); echo $template->render(['name' => $_GET['name']]) public function createTemplate(string $template, string $name = null): TemplateWrapper { if (!is_literal($template)) { throw new Exception('Can only accept a literal'); } ... } Is a Safe Literal?
91. $template = $twig->createTemplate('<p>Hello ' . $_GET['name'] . '</p>'); echo $template->render() public function createTemplate(string $template, string $name = null): TemplateWrapper { if (!is_literal($template)) { throw new Exception('Can only accept a literal'); } ... } Not a Safe Literal
92. if (function_exists('is_literal') && !is_literal($a)) { trigger_error('Can only accept a literal', E_USER_NOTICE); } Backwards compatibility Notices might be safer for legacy projects.
93. if (!function_exists('is_literal')) { function is_literal($variable) { return true; } } Backwards compatibility
94. $sql .= 'ORDER BY ' . $ fi eld_name; What about Table and Field names?
95. $ fi elds = [ 'name', 'created', 'admin', ]; $ fi eld_id = array_search(($_GET['sort'] ?? 'created'), $ fi elds); $sql = ' ORDER BY ' . $ fi elds[$ fi eld_id];
96. $sql .= 'WHERE id IN (1, 2, 3)'; What about WHERE IN?
97. $ids = [1, 2, 3]; $sql .= 'WHERE id IN (' . implode(', ', $ids) . ')'; From an unknown source
98. $ids = [1, 2, 3]; $sql .= 'WHERE id IN (' . implode(',', array_ fi ll(0, count($ids), '?')) . ')';
99. $ids = [1, 2, 3]; $sql .= 'WHERE id IN (' . implode(',', array_ fi ll(0, count($ids), '?')) . ')'; $sql .= 'WHERE id IN (?, ?, ?)';
100. Other Implementations
101. Google have a similar solution in Go: https://github.com/google/go-safeweb/tree/master/safehttp https://blogtitle.github.io/go-safe-html/ Other Implementations HTML Injection / XSS By Roberto Clapis
102. Google have a similar solution in Go: https://github.com/google/go-safeweb/tree/master/safesql A Query Builder, with an Append() method that only accepts compile-time constant strings (literal or const). Other Implementations SQL Injection
103. JavaScript may get a similar solution: https://github.com/tc39/proposal-array-is-template-object "Distinguishing strings from a trusted developer, from strings that may be attacker controlled" Other Implementations
104. Concerns
105. Concerns • Performance
106. Concerns • Performance Might not be able to justify string concatenation.
107. Concerns • Performance Might not be able to justify string concatenation. But could introduce a new function to combine an array of literals:
108. Concerns • Performance Might not be able to justify string concatenation. But could introduce a new function to combine an array of literals: $sql = ['SELECT u.name FROM user AS u']; if ($id) { $sql[] = 'WHERE id = ?'; $parameters[] = $id; } $sql = literal_implode(' ', $sql);
109. • Performance • Can array_ fi ll() + implode() pass though the "is_literal" fl ag? (WHERE IN) • Name it something else? • Variables, like a table pre fi x, being stored in an INI / JSON / YAML fi le? Concerns
110. The Future • Internal PHP functions, like mysqli_query(), preg_match(), exec(), etc; could all be setup to only accept safe literals. • When printing strings (i.e. sending HTML to the browser), this could be blocked, with an exception for your trusted HTML templating engine. Maybe PHP could only accept a speci fi c value object that has a __toString() method?
111. https://wiki.php.net/rfc/is_literal https://github.com/craigfrancis/php-is-literal-rfc Thank You