search

alexeyrybak / blitz

Blitz templates, template engine extension for PHP
Other
92 stars 42 forks source link

PHP callbacks restrictions (was: About PHP callback) #32

Open masiqbal opened 9 years ago

masiqbal commented 9 years ago

PHP callback is great. But it has security problem when we are in shared environment where we offer users to create their own templates only without accessing PHP code.

Imagine how dangerous this code: {{ php::exec("rm -rf /home") }}

It can be avoided by simply disabling PHP callback, but I think it is good idea to make new directive eg. blitz.allowed_php_functions and blitz.allowed_php_class

alexeyrybak commented 9 years ago

I will keep this here, in general I agree with the feature but I will not have time to implement this in near future. Maybe create a quickfix to disable exec, or enable everything from a specific class/namespace. To be fair, I added callbacks just because "every template system has callbacks" but we (Badoo) never used that much. So any comments and ideas from other users on how to implement these restrictions are all welcomed and appreciated.

ghost commented 9 years ago

It's easy. Just process user template on upload, searching for {{\s[^:]+:: , and allow only the classes you allow specifically. Also, searching for {{\s[^(]+( will help you with finding 'generic' callbacks like {{exec(...)}}, then you may only allow 'q' here, and be safe.