Smarty

[andreas]

Hi!

To prevent XSS I would like to use htmlentities() on every variable, assigned to any template. The best would be if something like that does not need to modify all assigned values (arrays, objects...), but modify only all (smarty-) variables in the template, when compiling it. I don't think that this could be solved using post/output filters, because these can only work on the whole template, not only on the values inserted (AFAIK).

Do you have any ideas what is the best place to implement something like that, or do you know a (existing) solution?

best regards
Andreas

[boots]

http://smarty.php.net/manual/en/variable.default.modifiers.php

[andreas]

That's what I was looking for!

Thank you very much!

[andreas]

OK, unfortunately it does not work for me

I can brake it using the following code:

php:

[boots]

Searching the forums can save time:

http://www.phpinsider.com/smarty-forum/viewtopic.php?t=2179
http://www.phpinsider.com/smarty-forum/viewtopic.php?t=4011

[andreas]

[boots]

Does this not work?

[andreas]

I have not tried because I had to change a lot of files. I think it would work, but I don't like to solve it this way.

I thought about using a default_modifiers function which does something like that:

[boots]

hmm. Actually, not too bad of a compromise...I'll have to test it but in the end I suspect it is still not suitable for the reasons I gave above.

[andreas]

[andreas]

[boots]

I understand why you are trying to solve this -- XSS is an important problem. Still, I think that your patch has the same general problem as default modifiers though I do think it is probably more usable. I'll try to illustrate my point by using a (contrived) example --

Say I had an assigned string:
[php:1:0227114206]$smarty->assign('sometext', 'love > science');[/php:1:0227114206]
Now I want to use a hypothetical custom plugin that takes text as input and generates a custom image for each character in the text using a different font styling. It then returns a string of html <img> tags that point to each of the generated images.

[andreas]

I don't think this will break, because of

[php]if (preg_match('~^' . $this-&gt;_num_const_regexp . '|' . $this-&gt;_obj_call_regexp . '|' . $this-&gt;_var_regexp . '$~', $tag_command)) {
/* tag name is a variable or object */[/php]

but I'm not sure. Only if

[andreas]

Perhaps you could somehow mark modifiers/functions which will output html! I think this could solve the problem. Perhaps it would be useful to implement functionality so that these plugins could also use the escaping. HTML_* function could be implemented somewhere without changing these functions (I think), but you can't do this with other user-functions. Perhaps one could implement something these functions can use if they want to escape data if default_modifiers are enabled.

And yes, I see that this will break BC (but only for these people who use functions which output html AND use default_modifer for escaping ATM!), but wouldn't it be great to make it possible to generally escape output of variables in a convenient way? You don't need any nodefaults, you don't need own escape-functions...

I also see some limitations:

1. of someone who does not use html-escape before could get difficulties with inputfield-names, but that has nothing to do with my changes, this applies to the actual default_modifier too.

2. if someone wants to assign html-code to the templates, then he cannot use the default_modifier, or has to use nodefault. But he has to care for escaping himself, I don't think this is a good idea, but I'm sure there are situations where this is useful. But to say this again, nobody _must_ use default_modifiers. I only would like to finde an implementation which is more useful for most users.

3. if someone uses own functions/modifiers which output html or get special characters as input. I would try to solve this using some kind of "html_output" and/or "html_input" flag. If this is not set, the output should be escaped. Perhaps something like that.

I think XSS is one of the biggest problems in todays web-apps. In a template-engine as smarty I think you have the means to allow a convenient solution to the problem - at least for most people.

There have been ideas to change the behaviour of default_modifiers more than 1 year ago. Of course you cannot solve every problem, there will allways be situations when a global solution will not work. But as far as I can see it will be helpful for most applications. You have to weigh up which is more important - a convenient way to escape html-output, or break BC in user-functions working with html (but these are only affected if you activate default_modifier, and this is the same problem you have already today!).

The importance of XSS could be seen here:

* recent security-note from php-devs: http://www.php.net/security-note.php
* recent foundation of http://phpsec.org/
* http://groups-beta.google.com/groups?q=php+xss&qt_s=Search+Groups finds more than 1000 results

(small extra-benefit: you will save some [useless] methode-calls with my solutions at runtime, if you use default_modifiers)

[boots]

I really don't believe that security can be automated away. Never-the-less, I think that this patch has a better behaviour than the current implementation.

Monte, Messju, do either of you have an opinion on this?