3

I'm working on a module.

If the module is enabled, there would be an overview page showing the field structure of different content types. The visitor could then click a button to get a copy of the bundle's field structure (JSON encoded) and then use the code to create that content type on their site. Basically, like a feature except copy and paste rather than download.

What would potential security issues be? Is there any way to ensure that the hosting site (the site the content type is copied from) won't be able to do anything malicious?

2 Answers 2

2

Who would you expose this feature to?

If it's users with one of the permissions listed on http://drupal.org/security-advisory-policy then you shouldn't really worry about the security implications because those users can already do a lot of malicious things to the site.

I believe that all field names and field values should be filtered appropriately already and Drupal handles filtering on output, so I don't see a need for something like xss filter during import.

The fact that you want to use JSON instead of a PHP array as the method to represent the code seems great: copy/pasting PHP arrays around is an easy way to create an arbitrary code execution problem.

There is more discussion about safe ways to offer this feature in an issue in the Views queue.

If this doesn't answer your question please leave a comment and I'll do my best to expand.

2
  • Funny, I'm now 30 pages into Cracking Drupal :) For my use case, the big issue is that User 1 might copy the code from Site XX with an unknown admin. User 1 would then use the code as a parameter to pass to the entity_create function to create the Content Type. If User 1 doesn't understand what the bundle array is supposed to look like, could Site XX place anything in the code that would, say, wipe the server when the array was passed to entity_create?
    – linclark
    Apr 13, 2011 at 14:40
  • Yes. If you are using PHP objects/arrays then there are ways to include malicious code into them that will be executed as the code is included.
    – greggles
    Jun 14, 2011 at 18:01
0

I think that you can never really be sure what is on the hosting site, and should assume that it is untrustworthy.

Anywhere that text is rendered to the user can be used to display malicious content.

The bundle arrays are a known structure so you should be able to deduce which fields are displayed to the user and apply xxs filters when importing.

There may also be potential to bypass security by re using known field names (for example), so it is probably worth namspacing items in the array to prevent this.

so for example if a field was referred to as first_name you may want to convert this to importXXX_first_name.

2
  • This wouldn't actually be importing the content, it would be importing the content schema... the bundle array.
    – linclark
    Apr 13, 2011 at 12:01
  • Thanks, I have updated the answer, hope it makes a little more sense now. Apr 13, 2011 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.