PHP API Structure security enhancements - what can I do?

Question

I am rewriting my API for my app in PHP and am using the request structure

http://example.com/controller/function

and my API breaks up the request_uri into:

array(
        0 => "controller",
        1 => "function"
    );

and executes the requested function via the following code.

//Build the file name
$fileName = ('../controllers/' . $endpoint[0] . '.php');

//Look for the file that is being requested
if(!file_exists($fileName)){
    echo json_encode( StatusCodes["no_endpoint"] );
    die();
} else {
    include_once($fileName);
}

//Does the function exist?
if(!function_exists($endpoint[1])){
    echo json_encode( StatusCodes["no_function"] );
    die();
}

//Import the API settings to get all the keys necessary
include_once('../includes/ApiSettings.php');

//Include the common functions. Done here so the user can't bypass function_exists checks
include_once('../includes/CommonFunctions.php');

//Finally, execute the requested function
echo json_encode($endpoint[1]());

as one of my colleagues has pointed out to me, executing through echo json_encode($endpoint[1]()); can lead to people getting out of the webroot directory, or echoing system information back, for instance, if they hit the endpoint http://example.com/controller/phpinfo. Which is a MAJOR security issue.

What method should I be using instead, or how can I prevent people from doing remote code execution and causing all kinds of problems.

Dont worry of phpinfo worry about eval, system and i believe there was a PHP function that can read anny file and return the content as base64 — Raymond Nijland
– Raymond Nijland, Commented May 29, 2018 at 15:37
NULL bytes also might be a problem php.net/manual/en/security.filesystem.nullbytes.php — Raymond Nijland
– Raymond Nijland, Commented May 29, 2018 at 15:43

Quentin · Accepted Answer · 2018-05-29 15:18:35Z

2

Create an array of functions that are acceptable to call and use it as a whitelist. Check against that and not against every function that exists.

answered May 29, 2018 at 15:18

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP API Structure security enhancements - what can I do?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related