1 | <?php |
||
6 | class V2PropertyContainer extends ContainerMagic implements IPropertyContainer { |
||
7 | |||
8 | /** |
||
9 | * Property descriptions |
||
10 | * |
||
11 | * @var array[] |
||
12 | */ |
||
13 | protected $properties = array(); |
||
14 | |||
15 | /** |
||
16 | * Array of accessors - getters/setters/etc |
||
17 | * |
||
18 | * Getter is a callable like |
||
19 | * function () use ($that) {} |
||
20 | * or Pimple-like (P_CONTAINER_GETTER_PIMPLE) |
||
21 | * function ($this) {} |
||
22 | * |
||
23 | * Setter is a callable like |
||
24 | * function ($value) use ($that) {} |
||
25 | * |
||
26 | * Importer is a callable like |
||
27 | * function (&$row) use ($this) {} |
||
28 | * |
||
29 | * Exporter is a callable like |
||
30 | * function (&$row) use ($this) {} |
||
31 | * |
||
32 | * @var callable[][] |
||
33 | */ |
||
34 | protected $accessors; |
||
35 | |||
36 | public function setProperties($properties) { |
||
39 | |||
40 | // TODO - batch assign |
||
41 | public function assignAccessor($varName, $type, $callable) { |
||
52 | |||
53 | public function __set($name, $value) { |
||
62 | |||
63 | public function __get($name) { |
||
72 | |||
73 | public function __isset($name) { |
||
78 | |||
79 | public function clearProperties() { |
||
84 | |||
85 | } |
||
86 |
$this->accessors[$name][P_CONTAINER_SETTER]
can contain request data and is used in code execution context(s) leading to a potential security vulnerability.1 path for user data to reach this point
$_POST
in includes/general.php on line 258
$value
is assignedin includes/general.php on line 266
in includes/classes/Buddy/BuddyContainer.php on line 81
in includes/classes/Buddy/BuddyModel.php on line 237
$cBuddy->buddy_id
is passed to V2PropertyContainer::__set()in includes/classes/Buddy/BuddyModel.php on line -1
in includes/classes/V2PropertyContainer.php on line 55
in includes/classes/V2PropertyContainer.php on line 57
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: