-
Carsten Rose authoredCarsten Rose authored
Security.rst 7.36 KiB
Security
All values passed to QFQ will be:
- Checked against max. length and allowed content, on the client and on the server side. On the server side, the check happens before any further processing. The 'length' and 'allowed' content is specified per FormElement. 'digit' or 'alnumx' is the default. Violating the rules will stop the 'save record' process (Form) or result in an empty value (Report). If a variable is not replaced, check the default sanitize class.
- Only elements defined in the Form definition or requested by Report will be processed.
- UTF8 normalized (normalizer::normalize) to unify different ways of composing characters. It's more a database interest, to work with unified data.
SQL statements are typically fired as prepared statements with separated variables. Further custom SQL statements will be defined by the webmaster - those do not use prepared statements and might be affected by SQL injection. To prevent SQL injection, every variable is by default escaped with mysqli::real_escape_string.
QFQ notice:
- Variables passed by the client (=Browser) are untrusted and use the default sanitize class 'digit' (if nothing else is specified). If alpha characters are submitted, the content violates digit and becomes therefore !!<name of sanitize class>!! - there is no error message. Best is to always use SIP (value is trustful) or at least digits for GET (=client) parameter (user might change those and therefore those are not trustful).
Get Parameter
QFQ security restriction:
- GET parameter might contain urlencoded content (%xx). Therefore all GET parameter will be processed by 'urldecode()'. As a result a text like '%nn' in GET variables will always be decoded. It's not possible to transfer '%nn' itself.
- GET values are limited to securityGetMaxLength (:ref:`extension-manager-qfq-configuration`) chars - any violation will stop QFQ. Individual exceptions are defined via :ref:`ExceptionMaxLength`.
- GET parameter 'type' and 'L' might affected by (T3, configuration dependent) cache poisoning. If they contain non digit values, only the first character is used (if this is a digit) or completely cleaned (else).