Presentation from PHP User Group Finland 24.11.2011 (in Finnish)

1. PHP User Group Finland
24.11.2011

2. • Carl (Kalle) Vuorinen • Matti Suominen
– :ssa – :ssa
vuodesta 2005 vuodesta 2007
• PHP kehittäjä • Tietoturvahörhö
• Tiiminvetäjä • Osakas
• Osakas

3. • Tietoturva • Zend Framework
– OWASP Top Ten – MVC framework
– 10 kriittisintä web – Komponentti kirjasto
sovellusten
tietoturvariskiä Extending the art & spirit of PHP, Zend
Framework is based on simplicity,
– Injektio, XSS, CSRF, object-oriented best practices,
salasanojen suojaus corporate friendly licensing, and a
https://www.owasp.org/index.php/Top_10_2010 rigorously tested agile codebase.
http://framework.zend.com/about/overview

11. • Erikoismerkkien muuntaminen
– Escaping
• Syötteiden tarkistukset
– Filtteröinti & validointi
• SQL lauseiden esikäsittely
– Prepared statements

12. • Zend_Db_Adapter & Zend_Db_Statement
$sql = 'SELECT * FROM bugs WHERE bug_id = ?';
$result = $db->fetchAll($sql, $bugId);
• Zend_Db_Select
$select = $db->select()
->from('products',
array('product_id', 'product_name', 'price'))
->where('price > ?', $minimumPrice);
• Zend_Db_Table
$table = new Bugs();
$rows = $table->find($bugId);

14. • Tulosteiden siistiminen
– Escape output
• Syötteiden tarkistukset
– Filtteröinti & validointi
• PHP session konfigurointi
– httpOnly cookie

15. • Zend_View escape() metodi
<?php foreach ($this->books as $key => $val): ?>
<tr>
<td><?php echo $this->escape($val['author']) ?></td>
<td><?php echo $this->escape($val['title']) ?></td>
</tr>
<?php endforeach; ?>

16. • Zend_Form ja Zend_Filter &
Zend_Validate
$this->addElement(
text', 'username', array(
'required' => true,
'label' => 'Username:',
'filters' => array('StringTrim', 'StringToLower'),
'validators' => array(
'Alnum',
array('Regex',
false,
array('/^[a-z][a-z0-9]{2,}$/'))
)
));
• Zend_Filter_Input

17. • HTMLPurifier
– HTML Purifier defeats XSS with an audited
whitelist
http://htmlpurifier.org/
– class My_Filter_HtmlPurifier
implements Zend_Filter_Interface

19. • Piilotettu uniikki tunniste
– Hidden unique token

20. • Zend_Form_Hash
$form->addElement('hash', 'no_csrf_foo', array('salt' => 'unique'));
• Automaattinen CSRF suojaus
– Extend Zend_Form
• Linkkien suojaus
– Javascript POST

22. • Hashing
– MD5 ei riitä
– bcrypt
– Hitaampi on parempi

23. • PHPASS
– Portable PHP password hashing framework
http://www.openwall.com/phpass/
– class My_Auth_Adapter_DbTableHash
extends Zend_Auth_Adapter_DbTable

25. • http://framework.zend.com/
• https://www.owasp.org/
• http://static.zend.com/topics/Webinar-Zend-Secure-Application-Development-with-
the-Zend-Framework.pdf
• http://htmlpurifier.org/
• http://blog.astrumfutura.com/2008/05/example-zend-framework-blog-application-
tutorial-part-8-creating-and-editing-blog-entries-with-a-dash-of-htmlpurifier/
• https://www.owasp.org/index.php/Cross-
Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet
• http://www.openwall.com/phpass/
• http://www.openwall.com/articles/PHP-Users-Passwords
• http://codahale.com/how-to-safely-store-a-password/