Questions about this topic? Sign up to ask in the talk tab.
Difference between revisions of "Improper signedness"
From NetSec
| Line 1: | Line 1: | ||
'''Improper signedness''' is caused by allowing signed data when expecting unsigned data. This can cause information disclosure or even code execution in extreme circumstances. Our previous "fixed" code in the "Integer Handled as String" section does still have this problem. It is handled as an integer but the sign is not considered, as "-10" is still a valid integer, this will slip through the (int) cast. Therefore, we need to pass this to the abs() function which takes the absolute value of the data. | '''Improper signedness''' is caused by allowing signed data when expecting unsigned data. This can cause information disclosure or even code execution in extreme circumstances. Our previous "fixed" code in the "Integer Handled as String" section does still have this problem. It is handled as an integer but the sign is not considered, as "-10" is still a valid integer, this will slip through the (int) cast. Therefore, we need to pass this to the abs() function which takes the absolute value of the data. | ||
| − | + | =Mitigation= | |
| + | ==[[PHP]]== | ||
| + | {{code|text=<source lang="php"> | ||
| + | <?php | ||
| + | $id = abs((int)$_GET['id']); | ||
| + | @mysql_query("SELECT * FROM user WHERE user_id = " . $id . " LIMIT 1"); | ||
| + | ?></source>}} | ||
| − | + | =Auditing= | |
| − | + | ==Unparamaterized Statements== | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ==Examples== | |
| − | + | =Mitigation= | |
| − | + | ||
| − | + | ==Rails== | |
| − | + | {{code|text=<source lang="ruby"> | |
| − | + | user = User.Find(:conditions => ['id = ?', params[id].to_i.abs]) | |
| + | </source>}} | ||
| + | |||
| + | =Auditing= | ||
[[Category:Secure programming]] | [[Category:Secure programming]] | ||
Latest revision as of 02:51, 12 May 2013
Improper signedness is caused by allowing signed data when expecting unsigned data. This can cause information disclosure or even code execution in extreme circumstances. Our previous "fixed" code in the "Integer Handled as String" section does still have this problem. It is handled as an integer but the sign is not considered, as "-10" is still a valid integer, this will slip through the (int) cast. Therefore, we need to pass this to the abs() function which takes the absolute value of the data.
Contents
Mitigation
PHP
<?php $id = abs((int)$_GET['id']); @mysql_query("SELECT * FROM user WHERE user_id = " . $id . " LIMIT 1"); ?> |
Auditing
Unparamaterized Statements
Examples
Mitigation
Rails
user = User.Find(:conditions => ['id = ?', params[id].to_i.abs]) |
