secure php development with inspekt

PUT DOWN THE SUPERGLOBALS!Secure PHP Dev with Inspekt

Ed Finkler • inspekt.org • @funkatron

tek-X 2010 • #tekx • #inspekt • http://joind.in/1593

http://joind.in/1593

http://joind.in/1593

Thursday; May 20, 2010 - Inspekt.org

Vulnerabilities!


What causes them?


Letting bad stuff in!


Where's bad stuff?


EVERYWHERE!!!


☞ FIEO ☜


Keep bad stuff from getting in


Don't send bad stuff out


Most of us know this


PHP makes it harderthan it should be


It should be easyto do safe things


It should be hardto do dangerous things


Right nowit's harder to be safe


That sucks


That won't changeanytime soon


Inspekt is an attemptto change that


Make developers show intent


Stop direct accessto Superglobals


example: SuperCage


Consequences


Simplify


Centralize


Avoid piecemeal filtering


Force demonstration of intent


Auditability


☞ $_ ☜OH NO YOU DIDN'T


Scoping


Superglobals are indeed GLOBAL


Use Singleton


Additional Functionality


Auto-filtering


example:config


wrap an arbitrary array in a cage


example:filter_array_cage


Build your own filters


example:extending


filter an array or scalar


example:filter_static_methods


Questions?

http://funkatron.github.com/inspekt/



secure php development with inspekt

Technology

bad stu

thursday

org

inspekt

harder