1 | <?php |
||
25 | trait DriverBaseTrait |
||
26 | { |
||
27 | use ExtendedCacheItemPoolTrait; |
||
28 | |||
29 | /** |
||
30 | * @var array default options, this will be merge to Driver's Options |
||
31 | */ |
||
32 | protected $config = []; |
||
33 | |||
34 | /** |
||
35 | * @var bool |
||
36 | */ |
||
37 | protected $fallback = false; |
||
38 | |||
39 | /** |
||
40 | * @var mixed Instance of driver service |
||
41 | */ |
||
42 | protected $instance; |
||
43 | |||
44 | /** |
||
45 | * @param $config_name |
||
46 | * @param string $value |
||
47 | */ |
||
48 | public function setup($config_name, $value = '') |
||
59 | |||
60 | /** |
||
61 | * @return array |
||
62 | */ |
||
63 | public function getConfig() |
||
67 | |||
68 | /** |
||
69 | * Encode data types such as object/array |
||
70 | * for driver that does not support |
||
71 | * non-scalar value |
||
72 | * @param $data |
||
73 | * @return string |
||
74 | */ |
||
75 | protected function encode($data) |
||
79 | |||
80 | /** |
||
81 | * Decode data types such as object/array |
||
82 | * for driver that does not support |
||
83 | * non-scalar value |
||
84 | * @param $value |
||
85 | * @return mixed |
||
86 | */ |
||
87 | protected function decode($value) |
||
91 | |||
92 | /** |
||
93 | * Check phpModules or CGI |
||
94 | * @return bool |
||
95 | */ |
||
96 | protected function isPHPModule() |
||
108 | |||
109 | |||
110 | /** |
||
111 | * @param $class |
||
112 | * @return bool |
||
113 | */ |
||
114 | protected function isExistingDriver($class) |
||
118 | |||
119 | |||
120 | /** |
||
121 | * @param $tag |
||
122 | * @return string |
||
123 | */ |
||
124 | protected function _getTagName($tag) |
||
128 | |||
129 | /** |
||
130 | * @param \phpFastCache\Core\Item\ExtendedCacheItemInterface $item |
||
131 | * @return array |
||
132 | */ |
||
133 | public function driverPreWrap(ExtendedCacheItemInterface $item) |
||
155 | |||
156 | /** |
||
157 | * @param array $wrapper |
||
158 | * @return mixed |
||
159 | */ |
||
160 | public function driverUnwrapData(array $wrapper) |
||
164 | |||
165 | /** |
||
166 | * @param array $wrapper |
||
167 | * @return mixed |
||
168 | */ |
||
169 | public function driverUnwrapTags(array $wrapper) |
||
173 | |||
174 | |||
175 | /** |
||
176 | * @param array $wrapper |
||
177 | * @return \DateTime |
||
178 | */ |
||
179 | public function driverUnwrapEdate(array $wrapper) |
||
183 | |||
184 | /** |
||
185 | * @param array $wrapper |
||
186 | * @return \DateTime |
||
187 | */ |
||
188 | public function driverUnwrapCdate(array $wrapper) |
||
192 | |||
193 | |||
194 | /** |
||
195 | * @param array $wrapper |
||
196 | * @return \DateTime |
||
197 | */ |
||
198 | public function driverUnwrapMdate(array $wrapper) |
||
202 | |||
203 | /** |
||
204 | * @return string |
||
205 | */ |
||
206 | public function getDriverName() |
||
212 | |||
213 | /** |
||
214 | * @param \phpFastCache\Core\Item\ExtendedCacheItemInterface $item |
||
215 | * @return bool |
||
216 | * @throws \LogicException |
||
217 | */ |
||
218 | public function driverWriteTags(ExtendedCacheItemInterface $item) |
||
289 | |||
290 | /** |
||
291 | * @param $key |
||
292 | * @return string |
||
293 | */ |
||
294 | public function getTagKey($key) |
||
298 | |||
299 | /** |
||
300 | * @param $key |
||
301 | * @return string |
||
302 | */ |
||
303 | public function getTagKeys(array $keys) |
||
311 | |||
312 | /** |
||
313 | * @param string $optionName |
||
314 | * @param mixed $optionValue |
||
315 | * @return bool |
||
316 | * @throws \InvalidArgumentException |
||
317 | */ |
||
318 | public static function isValidOption($optionName, $optionValue) |
||
326 | |||
327 | /** |
||
328 | * @return array |
||
329 | */ |
||
330 | public static function getRequiredOptions() |
||
334 | |||
335 | /** |
||
336 | * @return array |
||
337 | */ |
||
338 | public static function getValidOptions() |
||
342 | } |
$value
can contain request data and is used in unserialized context(s) leading to a potential security vulnerability.2 paths for user data to reach this point
$_COOKIE,
and$_COOKIE[$keyword]
is decoded by json_decode(), andjson_decode($_COOKIE[$keyword], true)
is passed to DriverBaseTrait::decode() in src/phpFastCache/Drivers/Cookie/Driver.php on line 104$_COOKIE,
and$_COOKIE[$keyword]
is decoded by json_decode(), andjson_decode($_COOKIE[$keyword], true)
is passed to DriverBaseTrait::decode()in src/phpFastCache/Drivers/Cookie/Driver.php on line 104
HTTP_HOST
from$_SERVER,
and$_SERVER['HTTP_HOST']
is passed through str_replace(), andstr_replace(':', '_', $_SERVER['HTTP_HOST'])
is passed through strtolower(), andstrtolower(str_replace(':', '_', $_SERVER['HTTP_HOST']))
is passed through preg_replace(), and$securityKey
is assigned in src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 61HTTP_HOST
from$_SERVER,
and$_SERVER['HTTP_HOST']
is passed through str_replace(), andstr_replace(':', '_', $_SERVER['HTTP_HOST'])
is passed through strtolower(), andstrtolower(str_replace(':', '_', $_SERVER['HTTP_HOST']))
is passed through preg_replace(), and$securityKey
is assignedin src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 61
in vendor/src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 195
$securityKey
is assignedin src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 71
$full_path
is assignedin src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 88
$full_path
is passed through realpath()in src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 105
in src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 134
$path
is assignedin src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 145
$file_path
is assignedin src/phpFastCache/Drivers/Files/Driver.php on line 98
in vendor/src/phpFastCache/Core/Pool/IO/IOHelperTrait.php on line 240
$content
is assignedin src/phpFastCache/Drivers/Files/Driver.php on line 103
$content
is passed to DriverBaseTrait::decode()in src/phpFastCache/Drivers/Files/Driver.php on line 105
Preventing Object Injection Attacks
If you pass raw user-data to
unserialize()
for example, this can be used to create an object of any class that is available in your local filesystem. For an attacker, classes that have magic methods like__destruct
or__wakeup
are particularly interesting in such a case, as they can be exploited very easily.We recommend to not pass user data to such a function. In case of
unserialize
, better useJSON
to transfer data.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: