Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I've come across Twitto, which basically is a web framework that fits in a tweet. It is so short that I can post the code here :

require __DIR__.'/c.php';
if (!is_callable($c = @$_GET['c'] ?: function() { echo 'Woah!'; }))
  throw new Exception('Error');
$c();

It basically searches for a file named c.php and calls whatever function in that files that is the same name as $_GET['c'].

On the project's website, there is a big red banner at the bottom of the page that reads :

» TWITTO IS NOT SECURE, DON'T USE IT FOR YOUR NEXT WEBSITE «

I am no PHP guru, but to me it looks like if you take all the precautions you normally take with a standard PHP site (sanitizing user input, etc), it should be secure enough ?

What is wrong with this tiny framework ?

EDIT : I understand why this framework is not secure AS-IS, but with the proper bootstrapping and validation checks and everything inside the function you call, it should be just as secure as any other framework ?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

This is not secure, since it allows to run any function available on your system.

It's difficult to find a good example of a function which will cause too much harm, since, for example, PHP doesn't have a magic "format my server" parameterless function. Still:

twitto.php?c=phpinfo

for example will display everything about your system to a hacker. Pretty nice, isn't it?

In the same way, you may add some parameterless functions to your app, without expecting them to be called by the end users. For example:

  • DisplayUsersInfo() flushes the information about the users, including the sensitive data,

  • ShowAdminTab(TAB_USERS) shows the users tab in the administration panel by calling DisplayUsersInfo.

The ShowAdminTab($tab) is called only after authentication and other means which protect the administration panel from unauthorized access. Fine. Then somebody calls twitto.php?c=DisplayUsersInfo. No authentication required.

share|improve this answer

I'ts because of this:

The "Hello World!" controller is now accessible at /twitto.php?c=hello_world.

Anybody can execute your PHP SERVER SIDE code from any browser! (With a simple HTTP GET)!


EDIT I'm pretty sure this call any standard PHP function, Not just the ones in the C.php file, how can you secure that?

share|improve this answer
    
The function is called without any parameters... I can't think of anything harmful that could be done with a standard PHP function that takes no parameters –  marco-fiset Mar 15 '12 at 20:27
    
@CollinHockey Look at the Code, where is checking if the function called exists in the c.php file? Its just executing whatever is passed in. –  Morons Mar 15 '12 at 20:28
    
@Morons: It is executing whatever is passed id but without any parameters. Give me a standard PHP function that can break something which does not require any argument. –  marco-fiset Mar 15 '12 at 20:32
3  
What about this? php.net/manual/en/function.apache-child-terminate.php –  Morons Mar 15 '12 at 20:44
    
@Morons I didn't even think of that before. I wasn't thinking about built-ins, but only about the explicitly included files. –  Collin Mar 15 '12 at 20:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.