Difference between revisions of "Anonymous function calls"

Revision as of 01:25, 12 May 2013

Unsafe programmatic construct referencing Dynamic referencing of functions and classes through user input is dangerous and should never be done, some examples are listed below.

Unsafe PHP examples

• Anonymous function implementation example:

<?php
    $func = $_GET['func'];
    $func($args);
?>

• Anonymous object implementation example:

<?php
    $class = $_GET['object_type'];
    $object = new $class();
?>

• Anonymous object method implementation example:

<?php
    $class    = $_GET['object_type'];
    $method = $_GET['method'];
    $object   = new $class();
    $object->$method();
?>

Unsafe Perl examples

• Anonymous function implementation example:

#!/usr/bin/perl
$func = <>;
$func->();

• Anonymous object implementation example:

#!/usr/bin/perl
$class = <>;
$object = $class->new();

• Anonymous object method implementation example:

#!/usr/bin/perl
$class = <>;
$method = <>;
$object = $class->new()->method();

Unsafe Python examples

• Anonymous function implementation example:

          var = "function_name"
          locals()[var]() # or globals()

• Anonymous object implementation example:

          class_name = input()
          instance = globals()[class_name]()
          
          # OR
          instance = locals()[class_name]()
          
          # OR
          any_scoped_class = lambda x:  dict(target  for classlist in  [inspect.getmembers(sys.modules[module],inspect.isclass) for module in  sys.modules]  for target in classlist)[x]()
          instance = any_scoped_class(class_name)

• Anonymous object method implementation example:

          ClassName = "ObjectName"
          func_name = "object_method"
          instance = globals()[ClassName]()
          func = getattr(instance, func_name)
          instance.func();

Unsafe Ruby examples

• Anonymous function implementation example:

send("function_name")

• Anonymous object implementation example:

Object.const_get('ClassName').new()

• Anonymous object method implementation example:

Object.const_get("ClassName").new().send("function_name")

Mitigation

These functions are best left unused unless the data is whitelisted and not directly based on user input. There is no safe way to allow users to call arbitrary (non-whitelisted) classes and functions. Do not do this! Whitelists should always be in place when referencing objects from user input.

Whitelisting examples:

• PHP

         <?php
             $class_whitelist['class_name'] = 'real_class_name';
             
             if (isset($_GET['module']) &&                                                # Check that input is defined
                 isset($class_whitelist[$_GET['module']]  &&                       # Be sure the class is in the whitelist
                 class_exists($class_whitelist[$_GET['module']])) {              # even if its whitelisted, lets make sure its a class... typos exist.
                   $class = new $class_whitelist[$_GET['module']]();            # new real_class_name() - this way user input isn't trusted directly for instantiation.
             } else {
                 # Handle Error...
             }
         ?>

Auditing

To audit:

find -name \*.py -exec grep -EHnC2 "[a-zA-Z0-9\)]\[[^\'\"\]]\\+\]\(" '{}' \; \
                -o -name \*.rb -exec grep -EHnC2 "const_get\(\|send\(\|eval\(" '{}' \;