SlideShare a Scribd company logo
PUT DOWN THE SUPERGLOBALS!
      Secure PHP Dev with Inspekt

    Ed Finkler • inspekt.org • @funkatron 




      tek-X 2010 • #tekx • #inspekt • http://joind.in/1593
Vulnerabilities!




            Thursday; May 20, 2010 - Inspekt.org
What causes them?




            Thursday; May 20, 2010 - Inspekt.org
Letting bad stuff in!




              Thursday; May 20, 2010 - Inspekt.org
Where's bad stuff?




            Thursday; May 20, 2010 - Inspekt.org
EVERYWHERE!!!




         Thursday; May 20, 2010 - Inspekt.org
FIEO




       Thursday; May 20, 2010 - Inspekt.org
Keep bad stuff from getting in




                  Thursday; May 20, 2010 - Inspekt.org
Don't send bad stuff out




               Thursday; May 20, 2010 - Inspekt.org
Most of us know this




              Thursday; May 20, 2010 - Inspekt.org
PHP makes it harder
 than it should be



             Thursday; May 20, 2010 - Inspekt.org
It should be easy
to do safe things



            Thursday; May 20, 2010 - Inspekt.org
It should be hard
to do dangerous things



               Thursday; May 20, 2010 - Inspekt.org
Right now
it's harder to be safe



               Thursday; May 20, 2010 - Inspekt.org
That sucks




        Thursday; May 20, 2010 - Inspekt.org
That won't change
  anytime soon



            Thursday; May 20, 2010 - Inspekt.org
Inspekt is an attempt
   to change that



              Thursday; May 20, 2010 - Inspekt.org
Make developers show intent




                 Thursday; May 20, 2010 - Inspekt.org
Stop direct access
 to Superglobals



             Thursday; May 20, 2010 - Inspekt.org
example: SuperCage




            Thursday; May 20, 2010 - Inspekt.org
Consequences




         Thursday; May 20, 2010 - Inspekt.org
Simplify




           Thursday; May 20, 2010 - Inspekt.org
Centralize




         Thursday; May 20, 2010 - Inspekt.org
Avoid piecemeal filtering




                Thursday; May 20, 2010 - Inspekt.org
Force demonstration of intent




                  Thursday; May 20, 2010 - Inspekt.org
Auditability




          Thursday; May 20, 2010 - Inspekt.org
$_
OH NO YOU DIDN'T



          Thursday; May 20, 2010 - Inspekt.org
Scoping




          Thursday; May 20, 2010 - Inspekt.org
Superglobals are indeed
      GLOBAL



               Thursday; May 20, 2010 - Inspekt.org
Use Singleton




          Thursday; May 20, 2010 - Inspekt.org
Additional Functionality




                Thursday; May 20, 2010 - Inspekt.org
Auto-filtering




          Thursday; May 20, 2010 - Inspekt.org
example:config




         Thursday; May 20, 2010 - Inspekt.org
wrap an arbitrary array in a cage




                    Thursday; May 20, 2010 - Inspekt.org
example:filter_array_cage




               Thursday; May 20, 2010 - Inspekt.org
Build your own filters




              Thursday; May 20, 2010 - Inspekt.org
example:extending




            Thursday; May 20, 2010 - Inspekt.org
filter an array or scalar




                Thursday; May 20, 2010 - Inspekt.org
example:filter_static_methods




                 Thursday; May 20, 2010 - Inspekt.org
Questions?

http://funkatron.github.com/inspekt/



                         Thursday; May 20, 2010 - Inspekt.org

More Related Content

PPTX
Managing Mobility & The Consumerisation of IT
DOCX
Risk assessment Brighton
DOCX
Risk Assessment St Pauls
PDF
Building mobile apps with JavaScript and PHP
PDF
Implementing a WAF
PDF
台灣/中國網路經濟之社會觀察
PDF
Linked Data In Action
PDF
DAC 329 Zentation (PDF)
Managing Mobility & The Consumerisation of IT
Risk assessment Brighton
Risk Assessment St Pauls
Building mobile apps with JavaScript and PHP
Implementing a WAF
台灣/中國網路經濟之社會觀察
Linked Data In Action
DAC 329 Zentation (PDF)

More from funkatron (10)

PDF
JavaScript for PHP Developers
PDF
Building RIAs with CodeIgniter and JavaScript
PDF
JavaScript for PHP Developers
PDF
Building Desktop RIAs with JavaScript and PHP - ZendCon09
PDF
Building Desktop RIAs With PHP And JavaScript
PDF
Intro To Mvc Development In Php
PDF
Building Desktop RIAs with PHP, HTML & Javascript in AIR
PDF
Securing the PHP Environment with PHPSecInfo - OSCON 2008
PDF
Building Desktop RIAs with PHP, HTML & Javascript in AIR
PDF
Securing the PHP Environment with PHPSecInfo
JavaScript for PHP Developers
Building RIAs with CodeIgniter and JavaScript
JavaScript for PHP Developers
Building Desktop RIAs with JavaScript and PHP - ZendCon09
Building Desktop RIAs With PHP And JavaScript
Intro To Mvc Development In Php
Building Desktop RIAs with PHP, HTML & Javascript in AIR
Securing the PHP Environment with PHPSecInfo - OSCON 2008
Building Desktop RIAs with PHP, HTML & Javascript in AIR
Securing the PHP Environment with PHPSecInfo
Ad

Recently uploaded (20)

PPTX
A Presentation on Artificial Intelligence
PPT
Teaching material agriculture food technology
PPTX
Spectroscopy.pptx food analysis technology
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
PDF
Network Security Unit 5.pdf for BCA BBA.
PDF
Machine learning based COVID-19 study performance prediction
PDF
Encapsulation theory and applications.pdf
PDF
NewMind AI Weekly Chronicles - August'25-Week II
PDF
A comparative analysis of optical character recognition models for extracting...
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
PPTX
Machine Learning_overview_presentation.pptx
PPTX
MYSQL Presentation for SQL database connectivity
PDF
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
PPTX
Big Data Technologies - Introduction.pptx
PDF
Unlocking AI with Model Context Protocol (MCP)
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
PDF
Spectral efficient network and resource selection model in 5G networks
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
PDF
Electronic commerce courselecture one. Pdf
PDF
Chapter 3 Spatial Domain Image Processing.pdf
A Presentation on Artificial Intelligence
Teaching material agriculture food technology
Spectroscopy.pptx food analysis technology
Reach Out and Touch Someone: Haptics and Empathic Computing
Network Security Unit 5.pdf for BCA BBA.
Machine learning based COVID-19 study performance prediction
Encapsulation theory and applications.pdf
NewMind AI Weekly Chronicles - August'25-Week II
A comparative analysis of optical character recognition models for extracting...
Agricultural_Statistics_at_a_Glance_2022_0.pdf
Machine Learning_overview_presentation.pptx
MYSQL Presentation for SQL database connectivity
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Big Data Technologies - Introduction.pptx
Unlocking AI with Model Context Protocol (MCP)
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Spectral efficient network and resource selection model in 5G networks
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
Electronic commerce courselecture one. Pdf
Chapter 3 Spatial Domain Image Processing.pdf
Ad

Secure PHP Development with Inspekt