Yii mass variable attribute assignment and xss security issue

Question

$model->attributes = $_GET[ 'Submission' ];

It looks very scary for me, but this is how yii assigns model attributes. Is this a security risk to XSS? Isn't it necessary to sanitize first? I know that the models are checked, but is there enough of malicious input, especially if they are stored in the database, and if you forgot to clear the output ...

Answer 1

Massive assignment is not the default value of 'on'. It will be created only for fields that have passed some validation rule explicitly .

$model->attributes = $_GET[ 'Submission' ];

equivalent to this code,

$model->attribute1 = $_GET['Submission']['attribute1'];
$model->attribute2 = $_GET['Submission']['attribute2'];
$model->attribute3 = $_GET['Submission']['attribute3'];

XSS, SQL Injection, , ;

XSS, SQL Injection, CHtmlPurifier, HTML . CHtmlPurifier, - , XSS.

, ,

public function rules(){
    return array(
     array('username, password, salt, email', 'required'),
     array('username, password, salt, email', 'length', 'max'=>128),
     array('first_name,last_name,username,email','safe','on'=>'search'),
    );
 }

$model->attributes = $_GET[ 'Submission' ];

username email , first_name, last_name , . , , , , ,

 public function rules(){
        return array(
         array('username, password, salt, email', 'required'),
         array('username, password, salt, email', 'length', 'max'=>128),
         array('first_name,last_name','safe','on'=>'create,update'),
         array('first_name,last_name,username,email','safe','on'=>'search'),
        );
     }

, XX. XSS , ,

public function rules(){
            return array(
             array('username, password, salt, email', 'required'),
             array('username, password, salt, email', 'length', 'max'=>128),
             array('first_name,last_name,username,email','filter'=>array($obj=new CHtmlPurifier(),'purify')),
             array('first_name,last_name,username,email','safe','on'=>'search'),
            );
         }

first_name, last_name, username, email XSS, SQL .

Tl; DR

• Yii , .
• XSS ,

Answer 2

, , Yii http://www.yiiframework.com/wiki/275/how-to-write-secure-yii-applications/

, beforeSave()