search

davidyell / CakePHP-CurrencyExchange

A CakePHP plugin to convert currency into different currencies
4 stars 1 forks source link

[Security] $this->args[0] may be unfiltered #7

Open asgrim opened 9 years ago

asgrim commented 9 years ago

https://github.com/davidyell/CakePHP-CurrencyExchange/blob/3.x/src/Console/Command/RatesShell.php#L53

unfiltered

I'm not sure what happens under the hood as I'm not a Cake dev, but it looks like $this->args[0] is being used completely unfiltered. Always filter input and escape output :)

asgrim commented 9 years ago

Similar issue here, but much more obvious:

https://github.com/davidyell/CakePHP-CurrencyExchange/blob/3.x/src/Console/Command/RatesShell.php#L58

unfiltered-ext

You are storing unfiltered input into the cache - do you trust this data? (probably not, because it is from an external source).

davidyell commented 9 years ago

Sorry, I don't know how I would make the json api return safe.