Encrypting form data, risky with register_globals=on ? 
Author Message
 Encrypting form data, risky with register_globals=on ?

After data has been entered into an SSL protected webform and submitted
('post'ed), I want to encrypt the data using PGP (actually GnuPG) and email
it.

As I will use shared webhosting I cannot control the setting of
register_globals= and almost all webhosting companies have this set to =on
for compatibility purposes.

I have a few questions:

1/ Does this mean that there is a greater security risk and an increased
need to thoroughly validate the form's data, including stripping out
certain characters? Isn't this situation somewhat similiar to not calling
Perl using -T (taint mode)?

2/ Once the form's data has been 'post'ed, is it possible/preferable to PGP
encrypt the data directly from memory as opposed to writing (fwrite) the
forms data to a temporary (tempnam) file on disk (which poses a few
security problems)? If yes, what commands should I use? If you prefer to
point me to a particular webpage for more info. that's fine :)

Cheers,
Scrumpy!



Wed, 27 Apr 2005 06:23:20 GMT  
 Encrypting form data, risky with register_globals=on ?
Your concerns are valid ones. I think there are even more things to
think about. If security is really an issue, then I think you need more
control over your hosting situation.
Quote:

> After data has been entered into an SSL protected webform and
> submitted ('post'ed), I want to encrypt the data using PGP (actually
> GnuPG) and email it.

> As I will use shared webhosting I cannot control the setting of
> register_globals= and almost all webhosting companies have this set
> to =on for compatibility purposes.



Wed, 27 Apr 2005 13:26:27 GMT  
 Encrypting form data, risky with register_globals=on ?

Quote:

> After data has been entered into an SSL protected webform and submitted
> ('post'ed), I want to encrypt the data using PGP (actually GnuPG) and
> email it.

> As I will use shared webhosting I cannot control the setting of
> register_globals= and almost all webhosting companies have this set to =on
> for compatibility purposes.

> I have a few questions:

> 1/ Does this mean that there is a greater security risk and an increased
> need to thoroughly validate the form's data, including stripping out
> certain characters? Isn't this situation somewhat similiar to not calling
> Perl using -T (taint mode)?

No. The only problem with register_globals on is that if you use
uninitialized variables you may get into problems. If you set error
reporting to E_ALL while developing you will get warnings whenever you use
uninitialized variables, and thus it should be possible to avoid this.

If you make sure to use the superglobals $_POST, $_GET etc., and never use
an unitialized variable, your solution will work regardless of the register
globals setting, and not only be more secure, but also more portable.

But obviously, when handling data coming from the user, all the normal
precautions apply.

Quote:
> 2/ Once the form's data has been 'post'ed, is it possible/preferable to
> PGP encrypt the data directly from memory as opposed to writing (fwrite)
> the forms data to a temporary (tempnam) file on disk (which poses a few
> security problems)? If yes, what commands should I use? If you prefer to
> point me to a particular webpage for more info. that's fine :)

This depends on the setup, so yes, this is an issue to consider. I guess you
should be able to feed pgp data from stdin (looks like the -f switch is
what you need), but I haven't tried this so I can't guarantee anything, man
pgp :)

Andr N?ss



Wed, 27 Apr 2005 17:43:58 GMT  
 
 [ 3 post ] 

 Relevant Pages 

1. multipart form data & other form values

2. HTTP multipart/form-data form post

3. Encrypt Data Rows

4. Encrypt data file

5. Extracting data from encrypted datafiles??

6. exchanging encrypted data

7. eof fails when reading encrypted data in text file

8. Encrypting much data with AES and M2Crypto

9. ing binary data (parsing multipart/form-data)

10. sessions + register_globals off

11. question about security with register_globals

12. session with register_globals off

 

 
Powered by phpBB® Forum Software