Is there a need to misinform the value of $ _POST before using it in the PHP header (for redirection)

Question

Can I use the published value in the PHP redirect header safely without checking it:

header( "Location: $base".$_POST['return'] ); // $base is set to the base of the site 

(If the user somehow manipulates return into a file that does not exist, it simply returns a good 404 message)

Is there any danger in this? Is there anything that the user can install for him, it could jeopardize the system or cause harm in any way?

Answer 1

The header () function is no longer vulnerable to Splitting an HTTP Response . The only vulnerability you need to worry about is OWASP a10 - unapproved redirects and redirects .

Providing $base nothing but an empty string will prevent an attacker from redirecting a user to a remote domain, which can be useful for phishing. Redirecting to the same domain can be useful for an attacker if he checks the referent as a form of CSRF prevention, but this is a weak form of protection that you really should not use in any case. Even with the database, an attacker can change the path by specifying a value similar to: /../../../admin.php , but this still applies to the source domain, which in most cases is safe.

One great way to deal with unapproved redirects is to completely fix the problem without using the REQUEST variable. Instead, save it to $_SESSION['redirect'] and use it for the next query. To be a little more reliable, you could say $_SESSION['redirect_checkout'] or something special.

Another option is to use the white list, create a list of all the values ​​that you want to accept, and make sure that the value you specify is listed in your list.

Answer 2

Yes, absolutely! Do not trust the values ​​of $ _GET or $ _POST at any time!

Suppose a third-party site submits a form. It can post any address.

A simple solution would be to not include the address, but the md5 () hash of the address in the form. After the form is submitted, the task of your script is to map the hash to the actual address and then fix the Location header.

My other post may be of interest.

You can claim that your application is bulletproof. Why shouldn't I pass the url directly?

In fact, even well-designed applications are not bulletproof. Leave back and try to remember your last "Ah, I forgot something. Let me fix this event."

Have you checked each control each and every condition?

• The user double-clicks the submit button for the web form. Thus, the controller works twice.
• The user presses F5 repeatedly repeats the last update controller.
• The user somehow controls the parameters, and the controller is called with the values ​​turned off.

Therefore, I suggest not passing links or other parameters directly or unprotected / unapproved .

@Col. Shrapnel I fully understand that any URL can be sent to a web application at any time. This is trivial.

However, at a given point in the control stream, there are certain acceptable following states of the control stream.

To make sure that only those that have been achieved in the following control states are achieved, I suggest checking.

More general approach

In fact, the updated internal infrastructure never passes any parameters as GET or POST parameters from request to request . All parameters are saved and retrieved from the user session [inside the so-called stream, which is part of a larger control stream].

Using the framework, only one parameter is passed - FlowID. If the infrastructure does not find the FlowID in the session thread store, the environment throws an exception and the dispatcher displays an error message.

Answer 3

The rules for XSS and SQL injection are listed here.

Your URL contains a database, but this does not mean that an attacker can create a form that redirects to a page that displays or processes data from the URL, or to a page where you use the URL as the input to the database data.

Answer 4

I supported Stefan's answer.

I also have this to add. I wrote a nice class for creating and parsing URLs. You can use it to check if you want.

See Url.php and UrlTest.php for use.

https://github.com/homer6/altumo/tree/master/source/php/String

Hope this helps ...