16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
36 lines
802 B
Plaintext
36 lines
802 B
Plaintext
== How to fix it in Core PHP
|
|
|
|
=== Code examples
|
|
|
|
The following code is vulnerable to arbitrary code execution because it
|
|
builds and dynamically runs PHP code based on untrusted data.
|
|
|
|
==== Noncompliant code example
|
|
|
|
[source,php,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
$operation = $_GET['operation'];
|
|
eval("product_${operation}();"); // Noncompliant
|
|
----
|
|
|
|
==== Compliant solution
|
|
|
|
[source,php,diff-id=1,diff-type=compliant]
|
|
----
|
|
$allowed = ["add", "remove", "update"];
|
|
$operation = $allowed[$_GET["operationId"]];
|
|
if ($operation !== "") {
|
|
eval("product_${operation}();");
|
|
}
|
|
----
|
|
|
|
=== How does this work?
|
|
|
|
include::../../common/fix/introduction.adoc[]
|
|
|
|
include::../../common/fix/parameters.adoc[]
|
|
|
|
include::../../common/fix/allowlist.adoc[]
|
|
|
|
The compliant code example uses such a binding approach.
|