Security checklist for developers
This document is provided as a supplement to Security for developers . This is a list of common development tasks, and the security measures that need to be taken.
Security checklist
editIf you are working with ... | have you ... |
---|---|
Browser Cookiesedit |
# Attempt to fetch the UserID cookie value.
# Note: the value returned isn't trusted and is forced to be an int.
$sId = intval( $wgRequest->getCookie( 'UserID' ) );
|
Dynamic code generationedit |
Avoid using functions like
Sometimes you really do need these features (obviously Inline lambda functions will make it easier to make your callback inline while retaining the benefits of code that's written in native syntax instead of strings.
$str = preg_replace( "!" . preg_quote( $externalStr, '!' ) . "!", $replacement, $str );
|
External programsedit |
// Automatically escape any naughty characters
$result = Shell::command( $cmd, '--version' )
->params( 'some', 'extra', 'parameters' )
->execute();
Note that old |
Formsedit |
|
GET dataedit |
# Check if the action parameter is set to 'purge'
if ( $wgRequest->getVal( 'action' ) == 'purge' ) {
...
|
Output (API, CSS, JavaScript, HTML, XML, etc.)editAny content that MediaWiki generates can be a vector for XSS attacks. |
# rawElement() escapes all attribute values
# (which, in this case, is provided by $myClass)
echo Html::rawElement( 'p', [ 'class' => $myClass ] );
|
User provided CSSeditUser provided CSS (Say for use in a |
# let $CSSFromUser be the user's CSS.
echo Html::rawElement( 'p', [ 'style' => Sanitizer::checkCss( $CSSFromUser ) ] );
|
POST dataedit |
# Check if the action parameter is set to 'render'
if ( $wgRequest->getVal( 'action' ) == 'render' ) {
...
|
Query stringsedit |
|
Sessionsedit |
|
Reviewer anxietyedit |
# $wgRequest isn't yet available. Forced to use $_GET instead.
if ( $_GET['setupTestSuite'] !== null ) {
$setupTestSuiteName = $_GET['setupTestSuite'];
...
|
SQL queriesedit |
Automated checking
editSome of these issues can be checked with phan-taint-check-plugin, which is required for all MediaWiki code in Wikimedia production. This is of course just a tool, and it cannot detect all issue types, and may miss issues even in the issue types it can check for.