表单输入过滤和验证中的黑名单与白名单

问题描述

净化来自用户的输入的首选方法是什么?

which is the preferred approach in sanitizing inputs coming from the user?

谢谢！

推荐答案

我认为白名单是理想的方法，但是我从来没有遇到过真正的白名单 HTML 表单验证.例如，这里是一个 symfony 1.x 表单，带有来自 文档的验证:

I think whitelisting is the desired approach, however I never met a real whitelist HTML form validation. For example here is a symfony 1.x form with validation from the documentation:

class ContactForm extends sfForm
{
  protected static $subjects = array('Subject A', 'Subject B', 'Subject C');

  public function configure()
  {
    $this->setWidgets(array(
      'name'    => new sfWidgetFormInput(),
      'email'   => new sfWidgetFormInput(),
      'subject' => new sfWidgetFormSelect(array('choices' => self::$subjects)),
      'message' => new sfWidgetFormTextarea(),
    ));
    $this->widgetSchema->setNameFormat('contact[%s]');

    $this->setValidators(array(
      'name'    => new sfValidatorString(array('required' => false)),
      'email'   => new sfValidatorEmail(),
      'subject' => new sfValidatorChoice(array('choices' => array_keys(self::$subjects))),
      'message' => new sfValidatorString(array('min_length' => 4)),
    ));
  }
}

您看不到的是，它在没有验证设置的情况下接受新输入，并且不检查未在表单中注册的输入是否存在.所以这是一个黑名单输入验证.通过白名单，您将首先定义一个输入验证器，然后才将输入字段绑定到该验证器.通过像这样的黑名单方法，很容易忘记向输入添加验证器，如果没有它，它也可以完美运行，因此您不会注意到漏洞，只有在为时已晚...

What you cannot see, that it accepts new inputs without validation settings and it does not check the presence of inputs which are not registered in the form. So this is a blacklist input validation. By whitelist you would define an input validator first, and only after that bind an input field to that validator. By a blacklist approach like this, it is easy to forget to add a validator to an input, and it works perfectly without that, so you would not notice the vulnerability, only when it is too late...

假设的白名单方法如下所示:

A hypothetical whitelist approach would look like something like this:

class ContactController {
    /**
    * @input("name", type = "string", singleLine = true, required = false)
    * @input("email", type = "email")
    * @input("subject", type = "string", alternatives = ['Subject A', 'Subject B', 'Subject C'])
    * @input("message", type = "string", range = [4,])
    */
    public function post(Inputs $inputs){
        //automatically validates inputs
        //throws error when an input is not on the list
        //throws error when an input has invalid value
    }
}

/**
* @controller(ContactController)
* @method(post)
*/
class ContactForm extends sfFormX {

  public function configure(InputsMeta $inputs)
  {
    //automatically binds the form to the input list of the @controller.@method
    //throws error when the @controller.@method.@input is not defined for a widget
    $this->addWidgets(
      new sfWidgetFormInput($inputs->name),
      new sfWidgetFormInput($inputs->email),
      new sfWidgetFormSelect($inputs->subject),
      new sfWidgetFormTextarea($inputs->message)
    );
    $this->widgetSchema->setNameFormat('contact[%s]');
  }
}

这篇关于表单输入过滤和验证中的黑名单与白名单的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！