Re: php header injection

Article View: nl.comp.programmeren

Article #18

Back to nl.comp.programmeren Previous Next

#18

From: Tim Van Wassenhove
Date: Sat, 10 Feb 2007 11:19

49 lines
2987 bytes

flor schreef:

>>> Tim Van Wassenhove schreef:
>>>> if (strstr($email, "\n") !== FALSE) {
>>>>  header('Location: http://example.com');
>>>>  exit;
>>>> }

>> ah! blijkbaar werkt het wel als ik de ! weglaat:
>>  >> if (strstr($email, "\n") == FALSE)
> oeps, te vroeg victorie gekraaid...
> nu geeft hij ook bij geldige emailadressen dat het op een spambericht 
> gaat...

Ik kan je probleem niet reproduceren:


require_once('simpletest/unit_tester.php');
require_once('simpletest/reporter.php');

function DoesNotHaveNewLine($input) {
         return (strstr($input, "\n") === FALSE);
}

class TestOfDoesNotHaveNewLine extends UnitTestCase {
         function test1() {
                 $input = "mike@example.com";
                 $this->assertTrue(DoesNotHaveNewLine($input));
         }

         function test2() {
                 $input = "mike@example.com\n";
                 $this->assertFalse(DoesNotHaveNewLine($input));
         }

         function test3() {
                 $input = "mi\nbcc:john@example.com\r\n\r\n";
                 $this->assertFalse(DoesNotHaveNewLine($input));
         }
}

$test = &new TestOfDoesNotHaveNewLine();
$test->run(new HtmlReporter());




-- 
Tim Van Wassenhove <url:http://www.timvw.be/>

Technical Details

Message-ID: <26-dnUhwxpLeN1DYnZ2dneKdnZypnZ2d@scarlet.biz>

Path:

arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local01.nntp.dca.giganews.com!nntp.scarlet.biz!news.scarlet.biz.POSTED!not-for-mail

References:

<_dYxh.329365$zB3.6533177@phobos.telenet-ops.be> <MPG.20326fc52ebe7c7a98a4ff@news.individual.net> <NYmyh.331494$Mn7.6448246@phobos.telenet-ops.be> <q_OdnaaHRsXvFFbYRVnytQA@scarlet.biz> <0Pfzh.1619$Ja1.141448@phobos.telenet-ops.be> <0Sfzh.1624$xg.59451@phobos.telenet-ops.be> <DXfzh.1632$Gg.68676@phobos.telenet-ops.be>

Show Full Headers

Complete Article Headers

X-Google-Thread: 107324,d41daf92e1d7a0a0
X-Google-Thread: 114bee,d41daf92e1d7a0a0
X-Google-Attributes: gid107324,gid114bee,public
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local01.nntp.dca.giganews.com!nntp.scarlet.biz!news.scarlet.biz.POSTED!not-for-mail
NNTP-Posting-Date: Sat, 10 Feb 2007 05:19:31 -0600
Date: Sat, 10 Feb 2007 12:19:24 +0100
From: Tim Van Wassenhove <timvw@users.sourceforge.net>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
Newsgroups: nl.comp.programmeren,be.comp.internet.design
Subject: Re: php header injection
References: <_dYxh.329365$zB3.6533177@phobos.telenet-ops.be> <MPG.20326fc52ebe7c7a98a4ff@news.individual.net> <NYmyh.331494$Mn7.6448246@phobos.telenet-ops.be> <q_OdnaaHRsXvFFbYRVnytQA@scarlet.biz> <0Pfzh.1619$Ja1.141448@phobos.telenet-ops.be> <0Sfzh.1624$xg.59451@phobos.telenet-ops.be> <DXfzh.1632$Gg.68676@phobos.telenet-ops.be>
In-Reply-To: <DXfzh.1632$Gg.68676@phobos.telenet-ops.be>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Message-ID: <26-dnUhwxpLeN1DYnZ2dneKdnZypnZ2d@scarlet.biz>
Lines: 49
NNTP-Posting-Host: 62.235.212.163
X-Trace: sv3-cm6gmPidc74hGkSoCIMWZ2t+6l19+BeQjl4Jk+Mka29YNcAUUwDD3KdbAJYN9V7LxQOGZ/ioQ8FvYsU!5cDyXtuPhhOL/eXm3tB/SSkpnSi5oiAXgudis1ipeAq1lCRmlgV76pBhHRuPmdRrGtJdfdW0ukIC!cw7EvZrXaWdICw==
X-Complaints-To: abuse@scarlet.be
X-DMCA-Complaints-To: abuse@scarlet.biz
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.32

Reply to Parent Message