6

In checking my Magento-powered site for XSS, I've found a couple of problem forms in our custom code, that let users submit arbitrary HTML and script tags that we dutifully inject into our site. (This isn't a Magento bug.)

Instead of trying to always remember to apply a filter on output, I'd like set a PHP filter by default on all input--like filter.default = full_special_chars in /etc/php.ini. Then, if specific input data needs specific exceptions, use a filter_input() call with a more-correct filter (e.g., this input is an email address, so use FILTER_SANITIZE_EMAIL).

I know how to implement this in 100% scratch PHP code, but is there a "magento way" to achieve this?

6

You can make an observer method for this on the controller_action_predispatch event:

config.xml

<?xml version="1.0"?>
<config>
    <frontend>
        [...]
        <events>
            <controller_action_predispatch>
                <observers>
                    <something_meaningful_and_unique>
                        <class>yourmodule/observer</class>
                        <method>sanitizeParams</method>
                    </something_meaningful_and_unique>
                </observers>
            </controller_action_predispatch>
        </events>
        [...]
    </frontend>
</config>

Model/Observer.php

public function sanitizeParams()
{
    foreach (Mage::app()->getRequest()->getPost() as $key => $value) {
        $_POST[$key] = filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS);
    }
}

Expand this function as you see fit. It will be called before each page load and you can sanitize, unset or manipulate every Post, Get and File.

Please let me know if this is not the solution you were looking for.

  • Thanks, this helped me to fix my issue with magento 1.8.1 forms. Now still a user can post html/js but the script never run and is only saved and displayed. Is there anyway to avoid a user to enter html/js in some fields? – Altaf Hussain Sep 21 '14 at 12:14
  • Just checked it, and when i use this method, then i cant login to admin :( – Altaf Hussain Sep 21 '14 at 12:16
  • I have fixed the login issue. Check the my answer now. – Altaf Hussain Sep 23 '14 at 6:56
0

Following the Anton Evers answer, i have created an observer. But the problem was that the sanitizeParams method can only process post data which is in single dimension array. For login forms at admin and front end, the form fields for user name and password are in array format like below:

<input type="text" id="username" name="login[username]" value="" class="required-entry input-text">

<input type="password" id="login" name="login[password]" class="required-entry input-text" value="">

TO fix this issue, i have modified the code in observer as below:

 public function sanitizeParams($observer)
{
    if(!Mage::app()->getStore()->isAdmin())
    {
        $post = Mage::app()->getRequest()->getParams();
        foreach($post as $pkey => $pvalue)
        {
            if(is_array($post[$pkey]))
            {
                foreach($post[$pkey] as $key => $value)
                {
                    $post[$pkey][$key] = filter_var($value, FILTER_SANITIZE_SPECIAL_CHARS);
                }
            }
            else
            {
                $post[$pkey] = filter_var($pvalue, FILTER_SANITIZE_SPECIAL_CHARS);
            }
        }

        $_POST = $post;
    }
}

And it fixed my problem, and is working fine now.

Thanks.

0

A fully recursive solution would be:

public function sanitizeParams()
{
    if(!Mage::app()->getStore()->isAdmin())
    {
        foreach($value as $k=>$v){
            if(is_array($v))
            {
                $_POST[$k] = sanitizeParams($v);
            }
            else
            {
                $_POST[$k] = filter_var($v, FILTER_SANITIZE_SPECIAL_CHARS);
            }
        }
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.