0

are there any security concerns with Drupal's cache_set() and cache_get() functions? I mean, I receive some values through an Ajax-GET-request. Can I pass them to the two functions with the following validation?

Javascript:

//token was passed through drupal_add_js() to Drupal.settings.my_module
var url = path + token + '/' + var1 + '/' + var2;
$.get(url);

Page callback:

function my_module_ajax_callback($token, $var1, $var2) {  
  if (!empty($_SERVER['HTTP_X_REQUESTED_WITH'])
      && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest'
      && is_numeric($var1)
      && drupal_valid_token($token, $var1)) {

    if (is_numeric($var2) && $var2 >= 0 && $var2 < 3600) {
      //can I pass $var1 and $var2 to cache_get() and cache_set() at this point? e.g.:
      cache_set(var1, var2);
      //Are there still security risks?
    }
  }
}

I would welcome every advise.

Thanks!

Daniel

11
  • Most of the security in Drupal is achieved through menu router access, form CSRF, and output sanitizing. Make sure you handle the data properly after cache_get(_multiple) calls.
    – AKS
    Dec 5 '14 at 16:08
  • Thanks for your fast response! But there cannot happen some SQL injection with cache_get and cache_set? It is as save as Drupal's db functions (e.g. db_query)?
    – Daniel
    Dec 5 '14 at 16:18
  • If the cache is in the DB then yes @user3083978. Everything DB-related in Drupal runs through PDO with prepared statements. If you're using a 3rd party cache plugin you'll need to consult its code and make sure you're happy with how it sanitises input in whatever context that might be. And as Ayesh notes, always sanitise when you're outputting those vars
    – Clive
    Dec 5 '14 at 16:20
  • Thanks Clive for your fast response. I pass these vars to $form_state of a multi step form, but I think that this won't cause some of the security risks mentioned by Ayesh, right?
    – Daniel
    Dec 5 '14 at 16:31
  • 1
    Security is a huge topic and there is no single solution to make things secure. Always, always sanitize the user input whenever necessary. Cache tables, if you are using default cache, stores the values in the DB. Drupal uses PDO so as long as you use the API correctly, your module should be safe from SQL injections.
    – AKS
    Dec 5 '14 at 17:03
1

currently there are no known bugs which would cause any security issue using cache_set and cache_get. You can put any values there both key and value are escaped. for example you can try this key '; drop table abr;--' and it will be saved without any issues

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.