rspec/rules/S5135/php/rule.adoc

38 lines
643 B
Plaintext

include::../description.adoc[]
== Noncompliant Code Example
----
$data = $_GET["data"];
$object = unserialize($data);
// ...
----
== Compliant Solution
----
$data = $_GET["data"];
list($hash, $data) = explode('|', $data, 2);
$hash_confirm = hash_hmac("sha256", $data, "secret-key");
// Confirm that the data integrity is not compromised
if ($hash === $hash_confirm) {
$object = unserialize($data);
// ...
}
----
include::../see.adoc[]
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
include::../highlighting.adoc[]
endif::env-github,rspecator-view[]