PHP application code best practices

4/24/2019 Security Best Practices
webinars/SecurityBestPractices2/Webinar_Materials/?print-pdf#/ 1/39© 2019 Rogue Wave Software, Inc. All rights reserved
Webinar series: PHP security best practices
Part 2: Web security best practices for PHP

PHPsecuritybestpracticesPHPsecuritybestpractices
by Daryl Wood
Senior Technical Trainer
Webinar, April 25, 2019
Rogue Wave Software, Inc.

SessiononerecapSessiononerecap

PHPsecuritybestpracticesPHPsecuritybestpractices
FirstsessionrecapFirstsessionrecap
Part one of this series included:
Security attack types
Log monitoring
Attack injection
Attack severities and impacts
PHP version end of life

PHPapplicationsecurityPHPapplicationsecurity
BestpracticefundamentalsBestpracticefundamentals
Today's part of this includes:
Code: Injection handling input and output
Logs: Web server (Apache) and PHP application
Code: Di erent logs for di erent severities
Updating PHP on a staging server

CodeCode
InjectionhandlinginputandoutputInjectionhandlinginputandoutput

Code:InjectionhandlinginputandoutputCode:Injectionhandlinginputandoutput
InputreviewInputreview
What's considered data input:
A request from a web client
A data payload from a web service call
A data payload from an asynchronous (AJAX) request
Data from a persistent storage mechanism

Crosssiteinjection(XSS)Crosssiteinjection(XSS)

InputfilteringforXSSinjectionInputfilteringforXSSinjection
VulnerablecodeVulnerablecode
// Simulate injected post data
$_POST['username'] = 'pablo';
$_POST['comment'] = '<script>alert("document.cookie")</script>';
if($_POST && isset($_POST['username') && isset($_POST['comment'])) {
$result = null;
try {
$pdo = new PDO('mysql:unix_socket=/var/run/mysqld/mysqld.sock;dbname=blog',
'vagrant', 'vagrant');
$stmt = $pdo->query("INSERT INTO blog (username, comment) VALUES ({$_POST['username']},
{$_POST['comment']})");
if($stmt) $stmt->execute();
// Then subsequently
$result = $pdo->exec("SELECT * FROM blog WHERE username='{$_POST['username']}'");
} catch (Throwable $e){
// Handle ...
}
if($result){
echo $result['comment'];
}
}

InputfilteringforXSSinjectionInputfilteringforXSSinjection
FilteredcodeFilteredcode
// Simulate injected post data
$_POST['username'] = 'pablo';
$_POST['comment'] = '<script>alert("document.cookie")</script>';
// This code should be owned by the initial domain input handling
if($_POST && isset($_POST['username') && isset($_POST['comment'])) {
// Looking for an alpha numeric value
$cleanUsername = ctype_alnum($_POST['username']) ? $_POST['username'] : false;
// Looking for tag-based injection and stripping the tags
$cleanComment = strip_tags($_POST['comment']) ?? false;
if($cleanUsername && $cleanComment) {
// Persist the data with $cleanUsername and $cleanComment escaping with:
// * htmlspecialchars()
// * htmlentities()
// * or your framework escaping mechanism
}
}

SQLinjectionSQLinjection

InputfilteringforSQLinjectionInputfilteringforSQLinjection
// Simulate injected get data
$_GET['id'] = ';update blog set username = attacker where user_id = 1;';
$_GET['new-password'] = 'e44sxdfg3';
$_GET['submit'] = 'submit';
if ($_GET && isset($_GET['Submit'])) {
//Employ ACL to determine access
try {
$pdo = new PDO('mysql:unix_socket=/var/run/mysqld/mysqld.sock;dbname=blog',
'vagrant', 'vagrant');
$stmt = $pdo->query("SELECT first_name, last_name FROM blog
WHERE user_id = '{$_GET['id']}'");
$stmt->execute();
$result = $stmt->fetch(PDO::FETCH_ASSOC);
} catch (PDOException $e) {
// Handle ...
}
}

InputfilteringforSQLinjectionInputfilteringforSQLinjection
FilteredcodeFilteredcode
// Simulate injected get data
$_GET['id'] = ';update blog set username = attacker where user_id = 1;';
$_GET['new-password'] = 'e44sxdfg3';
$_GET['submit'] = 'submit';
if ($_GET && isset($_GET['id']) && isset($_GET['Submit'])) {
//Employ ACL to determine access
// Filter by type coercion on integer-type identifier
$cleanId = (int)$_GET['id'];
// Filter by using the ctype_alnum() function for none integer-type
// identifiers, and assuming here alpha numeric
$cleanId = ctype_alnum($_GET['id']) ? $_GET['id'] : false;
// Filter by stripping tags, as passwords can be just about any character combination
$cleanPass = strip_tags($_GET['new-password']);
if($cleanId && $cleanPass) {
// Escape, then persist and update the data with $cleanId and $cleanPass ...
} else {
echo 'Data invalid';
}
}

BrokensessionmanagementBrokensessionmanagement

// A controller responsible for login/logout actions
class LoginController {
// ...
public function logoutAction() {
$this->view->setTemplate('login');
$this->view->render();
}
// ...
}

RepairedcodeRepairedcode
// Assuming a controller handles the fix directly, or indirectly.
class LoginController {
// ...
public function logoutAction() {
// Destroy the session here,
session_destroy();
// or with some injected and dedicated Session-responsible
// object calling its destroy() method.
$this->session->destroy();
$this->view->setTemplate('login');
$this->view->render();
}
// ...
}

BruteforceBruteforce

// Simulate a billion-fold brute force attempt with minor changes to the password.
$_POST['username'] = 'admin';
$_POST['password'] = 'pA$$wORD';
if($_POST && isset($_POST['username']) && isset($_POST['password'])) {
$result = false;
$password = md5($_POST['password']);
try{
$stmt = $this->getPdo()->query("SELECT * FROM users WHERE
username='{$_POST['username']}' AND password='$password'");
$stmt->execute();
}catch(PDOException $e){ // Handle ...
}
if($result && count($result)) { // On success
// Redirect to password-protected area
} else { // On failure
echo "<p>Login unsuccessful</p>";
}
}

RepairedcodeRepairedcode
// Simulate a billion-fold brute force attempt with minor changes to the password.
$_POST['username'] = 'admin';
$_POST['password'] = 'pA$$wORD';
if($_POST && isset($_POST['username']) && isset($_POST['password'])) {
// Execute brute force detection code here ...
$cleanUser = ctype_alnum($_POST['username']) ? $_POST['username'] : false;
if($cleanUser){
try{
$stmt = $this->getPdo()->query("SELECT * FROM users WHERE username='$cleanUser'");
$stmt->execute();
}catch(PDOException $e) { // Handle ...
}
}
if($result && count($result) && password_verify($_POST['password'], $result['password']) ) {
// Login successful, redirect to password-protected area escaping any input used ...
} else { //Login failed
echo "<p>Login unsuccessful</p>";
// Execute brute force detection code to record failed attempt
}
}

LogsLogs
Webserver(Apache)andPHPapplicationWebserver(Apache)andPHPapplication

Logs:Webserver(Apache)andPHPapplicationLogs:Webserver(Apache)andPHPapplication
LoglocationLoglocation
Here restated are the default log locations for a Debian-based Linux
server and PHP installation:
Syslog: /var/log/syslog
Apache access: /var/log/apache2/access.log
Apache error: /var/log/apache2/error.log
PHP error When enabled, and by default, is the syslog.
Instead of these defaults, we concern ourselves with Apache access
and error logging for a speci c host, and separate logs for critical PHP
error severities from all other severities.

SpecificApachehostloggingSpecificApachehostlogging
This code block shows an Apache virtual host con guration for host-
speci c access and error logging.
https://httpd.apache.org/
<VirtualHost *:80>
ServerName rockets.com
DocumentRoot /var/www/rockets
<Directory /var/www/rockets/>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require all granted
</Directory>
# Custom host-specific logging
ErrorLog /var/www/rockets/error.log
CustomLog /var/www/rockets/access.log combined
</VirtualHost>

PHPapplicationerrorloggingPHPapplicationerrorlogging
These code blocks shows production environment PHP con guration
directives enabling error reporting, logging, and location for
application-speci c PHP error logging.
In a web server php.ini con guration le:
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
log_errors = On
error_log = /var/www/rocket/logs/error.log

CodeCode
DifferentlogsfordifferentseveritiesDifferentlogsfordifferentseverities

CodeCode
DifferentlogsfordifferentseveritiesDifferentlogsfordifferentseverities
It is often helpful to direct speci c error severities to dedicated log les.
The next few slides de ne one way of doing that in object-oriented
code.

Code:DifferentlogsfordifferentseveritiesCode:Differentlogsfordifferentseverities
ALoggerclassALoggerclass
class Logger{
public static $critical_log, $warning_notice_log;
protected static $error;
public static function handler(...$error) {
self::$error = $error;
// Checks if error code is not part of error_reporting and bail
if (!(error_reporting() & self::$error[0])) return;
self::log();
}
public static function log(){
$logEntry = date('Ymd.h.m.s').'|'.self::$error[1].'|'.self::$error[2].'|'.
self::$error[3] . PHP_EOL;
switch (true){
case (self::$error[0] === E_ERROR || self::$error[0] === E_USER_ERROR):
return error_log($logEntry, 3, self::$critical_log);
case (self::$error[0] === E_WARNING || self::$error[0] === E_NOTICE):
return error_log($logEntry, 3, self::$warning_notice_log);
// ...
}
return false;
}
}

TheloggerruntimeTheloggerruntime
require 'Logger.php'; // Import the logger
set_error_handler(['Logger', 'handler']); // Set the handler code
// Set log entry destination for warnings and notices
Logger::$warning_notice_log = 'logs/warning_notice.log';
// Set log entry destination for critical errors
Logger::$critical_log = 'logs/critical.log';
// Force simulate a warning error with an empty explode function call,
explode();
// or force a triggered warning
trigger_error("A warning error happened", E_WARNING);
// Force simulate a critical error with an unloaded class.
try{
$object = new MissingObject();
} catch (Throwable $e){
Logger::handler(E_ERROR, $e->getMessage(), $e->getFile(), $e->getLine());
echo 'Server unable to grant request at this time';
}

UpdatingPHPonastagingserverUpdatingPHPonastagingserver

Production servers must be kept up to date for the security, bug xes,
and system optimization bene ts.
A staging server is a server environment that:
Matches a production server
Same software
Same software update process
Identical in deployment process
Can fail without production impact

A Staging server allows re nements to all update, deployment, and
continuous delivery processes.
But, should be subject to the same rigor as a production server,
including:
Assessment process
Functionality
Performance requirements
Security

RecapRecap

RecapRecap
Let's recap:
Input injection handling of a few of the most predominate attacks
The di erence between the Web server and PHP application error
logging
Setup di erent logs for di erent severities
Staging server purpose and recommendations

$3.86 million
Average cost of a data breach
197 days
Mean time to identify a breach
75%
of attacks occur on web apps
27%
likelihood of a recurring material breach
over the next two years
Over 60%
are running on vulnerable, unsupported
PHP runtime versions
BusinessimpactofapplicationsecurityBusinessimpactofapplicationsecurity

Zend Server is a commercially
supported & secure PHP
destribution
Wide range of professional
services including migration,
audits & custom consulting
Online & onsite PHP training
from beginner to advanced, plus
PHP certi cation
HowcanRogueWavehelp?HowcanRogueWavehelp?

What'snext?What'snext?

ResourcesResources
Some followup resources:
Zend Server: zend.com/en/products/zend_server
PHP Security, support and migration: zend.com/phpsecurity
Training, PHP security and more: zend.com/en/services/training
2019 State of PHP Survey: https://www.surveymonkey.com/r/2019-
state-of-php

Q&AQ&A

Thankyou!Thankyou!
Contact Ryan: ryan.krszjzaniek@roguewave.com
Contact Daryl: daryl.wood@roguewave.com
Follow me on Twitter: @datashuttle

PHP application code best practices

Recomendados

Recomendados

Más contenido relacionado

Más de Zend by Rogue Wave Software

Más de Zend by Rogue Wave Software (20)

Último

Último (20)

PHP application code best practices