Questions about this topic? Sign up to ask in the talk tab.

Difference between revisions of "Anonymous function calls"

From NetSec
Jump to: navigation, search
(→‎Mitigation)
 
(One intermediate revision by one other user not shown)
Line 38: Line 38:
 
=== Unsafe [[Python]] examples ===
 
=== Unsafe [[Python]] examples ===
 
* Anonymous function implementation example:
 
* Anonymous function implementation example:
−
          var = "function_name"
+
{{code|text=<source lang="python">var = "function_name"
−
          locals()[var]() # or globals()
+
locals()[var]() # or globals()</source>}}
 
* Anonymous object implementation example:
 
* Anonymous object implementation example:
−
          class_name = input()
+
{{code|text=<source lang="python">class_name = input()
−
          instance = globals()[class_name]()
+
instance = globals()[class_name]()
−
         
+
# OR
−
          # OR
+
instance = locals()[class_name]()
−
          instance = locals()[class_name]()
+
# OR
−
         
+
any_scoped_class = lambda x:  dict(target  for classlist in  [inspect.getmembers(sys.modules[module],inspect.isclass) for module in  sys.modules]  for target in classlist)[x]()
−
          # OR
+
instance = any_scoped_class(class_name)
−
          any_scoped_class = lambda x:  dict(target  for classlist in  [inspect.getmembers(sys.modules[module],inspect.isclass) for module in  sys.modules]  for target in classlist)[x]()
+
</source>}}
−
          instance = any_scoped_class(class_name)
+
 
* Anonymous object method implementation example:
 
* Anonymous object method implementation example:
−
          ClassName = "ObjectName"
+
{{code|text=<source lang="python">ClassName = "ObjectName"
−
          func_name = "object_method"
+
func_name = "object_method"
−
          instance = globals()[ClassName]()
+
instance = globals()[ClassName]()
−
          func = getattr(instance, func_name)
+
func = getattr(instance, func_name)
−
          instance.func();
+
instance.func();</source>}}
 +
 
 
=== Unsafe [[Ruby]] examples ===
 
=== Unsafe [[Ruby]] examples ===
 
* Anonymous function implementation example:
 
* Anonymous function implementation example:
Line 69: Line 69:
 
'''Whitelisting examples:'''
 
'''Whitelisting examples:'''
 
* [[PHP]]
 
* [[PHP]]
−
          <?php
+
 
−
              $class_whitelist['class_name'] = 'real_class_name';
+
{{code|text=<source lang="php">
 +
<?php
 +
    $class_whitelist['class_name'] = 'real_class_name';
 
                
 
                
−
              if (isset($_GET['module']) &&                                                # Check that input is defined
+
    if (isset($_GET['module']) &&                                                # Check that input is defined
−
                  isset($class_whitelist[$_GET['module']]  &&                      # Be sure the class is in the whitelist
+
      isset($class_whitelist[$_GET['module']]  &&                      # Be sure the class is in the whitelist
−
                  class_exists($class_whitelist[$_GET['module']])) {              # even if its whitelisted, lets make sure its a class... typos exist.
+
      class_exists($class_whitelist[$_GET['module']])) {              # even if its whitelisted, lets make sure its a class... typos exist.
−
                    $class = new $class_whitelist[$_GET['module']]();            # new real_class_name() - this way user input isn't trusted directly for instantiation.
+
        $class = new $class_whitelist[$_GET['module']]();            # new real_class_name() - this way user input isn't trusted directly for instantiation.
−
              } else {
+
    } else {
−
                  # Handle Error...
+
        # Handle Error...
−
              }
+
    }
−
          ?>
+
?>
 +
</source>}}
  
 
=== Auditing ===  
 
=== Auditing ===  

Latest revision as of 01:42, 12 May 2013

Unsafe programmatic construct referencing Dynamic referencing of functions and classes through user input is dangerous and should never be done, some examples are listed below.

Unsafe PHP examples

  • Anonymous function implementation example:
<?php
    $func = $_GET['func'];
    $func($args);
?>
  • Anonymous object implementation example:
<?php
    $class = $_GET['object_type'];
    $object = new $class();
?>
  • Anonymous object method implementation example:
<?php
    $class    = $_GET['object_type'];
    $method = $_GET['method'];
    $object   = new $class();
    $object->$method();
?>

Unsafe Perl examples

  • Anonymous function implementation example:
#!/usr/bin/perl
$func = <>;
$func->();
  • Anonymous object implementation example:
#!/usr/bin/perl
$class = <>;
$object = $class->new();
  • Anonymous object method implementation example:
#!/usr/bin/perl
$class = <>;
$method = <>;
$object = $class->new()->method();

Unsafe Python examples

  • Anonymous function implementation example:
var = "function_name"
locals()[var]() # or globals()
  • Anonymous object implementation example:
class_name = input()
instance = globals()[class_name]()
# OR
instance = locals()[class_name]()
# OR
any_scoped_class = lambda x:  dict(target  for classlist in  [inspect.getmembers(sys.modules[module],inspect.isclass) for module in  sys.modules]  for target in classlist)[x]()
instance = any_scoped_class(class_name)
 
  • Anonymous object method implementation example:
ClassName = "ObjectName"
func_name = "object_method"
instance = globals()[ClassName]()
func = getattr(instance, func_name)
instance.func();

Unsafe Ruby examples

  • Anonymous function implementation example:
send("function_name")
  • Anonymous object implementation example:
Object.const_get('ClassName').new()
  • Anonymous object method implementation example:
Object.const_get("ClassName").new().send("function_name")

Mitigation

These functions are best left unused unless the data is whitelisted and not directly based on user input. There is no safe way to allow users to call arbitrary (non-whitelisted) classes and functions. Do not do this! Whitelists should always be in place when referencing objects from user input.


Whitelisting examples: 

 
<?php
    $class_whitelist['class_name'] = 'real_class_name';
 
    if (isset($_GET['module']) &&                                                # Check that input is defined
      isset($class_whitelist[$_GET['module']]  &&                       # Be sure the class is in the whitelist
      class_exists($class_whitelist[$_GET['module']])) {              # even if its whitelisted, lets make sure its a class... typos exist.
         $class = new $class_whitelist[$_GET['module']]();            # new real_class_name() - this way user input isn't trusted directly for instantiation.
    } else {
        # Handle Error...
    }
?>
 

Auditing

To audit: 

find -name \*.py -exec grep -EHnC2 "[a-zA-Z0-9\)]\[[^\'\"\]]\\+\]\(" '{}' \; \
                -o -name \*.rb -exec grep -EHnC2 "const_get\(\|send\(\|eval\(" '{}' \;
Retrieved from "http://nets.ec/index.php?title=Anonymous_function_calls&oldid=10841"