View Issue Detail

ID	Project	Category	Submitted / Last Updated
01486	UserSpice	Security Code	2022-03-22 13:31:08 / 2022-11-06 21:33:50
Reported	Banging Heads	Assigned To	Unassigned
Priority	urgent	Reported	5.4.1
Status	closed	Resolution Version and Commit
Summary	Input sanitize array keys
Description	Input::sanitize doesn't sanitize array keys. If relying on this method you could end up with XSS in a key then outputting it into a table for instance. I think it would make sense to change from: $postItems[$key]=self::sanitize($itemValue); to: $postItems[self::sanitize($key)]=self::sanitize($itemValue);

April 2022

Changing to security bug to avoid exploiting
May 2022

We need to unset the keys because sanitizing them would just mean that there would be a sanitized key and an unsanitized key. I tested this, but it would be cool if you guys did too. Then I may even make 5.4.2 an internal release and stick this in and just increment the version number. public static function recursive($object){ foreach($object as $key => $val){ $saveKey = $key; $saveVal = $val; unset($object[$key]); $saveKey = Input::sanitize($saveKey); if(is_array($val)){ $object[$saveKey] = self::recursive($saveVal); } else { $object[$saveKey] = self::sanitize($saveVal); } } return $object; }
May 2022

I guess $val would still be there even after unset.
May 2022

public static function recursive($object){ foreach($object as $key => $val){ $saveKey = $key; $saveKey = Input::sanitize($saveKey); if(is_array($val)){ $object[$saveKey] = self::recursive($val); } else { $object[$saveKey] = self::sanitize($val); } unset($object[$key]); } return $object; }