Web Security Fundamentals

<?php
declare(strict_types=1);

session_start(['cookie_httponly' => true, 'cookie_samesite' => 'Lax', 'use_strict_mode' => true]);

function csrf_token(): string
{
    return $_SESSION['csrf'] ??= bin2hex(random_bytes(32));
}

function verify_csrf(): void
{
    $sent = $_POST['_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
    if (!is_string($sent) || !hash_equals(csrf_token(), $sent)) {
        http_response_code(419);
        exit("CSRF token mismatch\n");
    }
}

// in every form:  <input type="hidden" name="_token" value="<?= csrf_token() ?>">
// in every POST, PUT, PATCH and DELETE handler, before doing anything:
verify_csrf();

$ curl -c jar -b jar -X POST localhost:8000/reviews/7/delete                     # no token
CSRF token mismatch                                                              # 419
$ curl -c jar -b jar -X POST localhost:8000/reviews/7/delete -d _token=0000      # wrong token
CSRF token mismatch                                                              # 419
$ curl -c jar -b jar -X POST localhost:8000/reviews/7/delete -d "_token=$TOKEN"  # token from the form
review 7 deleted                                                                 # 200
$ curl -c jar -b jar -X POST localhost:8000/reviews/7/delete -H "X-CSRF-Token: $TOKEN"
review 7 deleted

<?php
declare(strict_types=1);

// VULNERABLE: "import a cover image from a URL"
function fetchCoverNaive(string $url): string
{
    return file_get_contents($url);                    // any scheme, any host
}
echo substr(fetchCoverNaive('file:///etc/hostname'), 0, 40), "\n";      // 046dbde09bfa: a local file
echo substr(fetchCoverNaive('php://filter/convert.base64-encode/resource=/w/secret/config.php'), 0, 40), "\n";
// PD9waHAgcmV0dXJuIFsiZGJfcGFzc3dvcmQiID0+: the source of a PHP file, base64-encoded

<?php
declare(strict_types=1);

function fetchCover(string $input): string
{
    $url = Uri\WhatWg\Url::parse($input) ?? throw new InvalidArgumentException('Invalid URL');
    if ($url->getScheme() !== 'https') {
        throw new InvalidArgumentException('Only https URLs are allowed');
    }
    $host = trim($url->getAsciiHost(), '[]');
    $ips = filter_var($host, FILTER_VALIDATE_IP) !== false ? [$host] : (gethostbynamel($host) ?: []);
    foreach ($ips as $ip) {
        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
            throw new InvalidArgumentException("Address $ip is not public");
        }
    }
    if ($ips === []) {
        throw new InvalidArgumentException('Host does not resolve');
    }
    $ch = curl_init($url->toAsciiString());
    curl_setopt_array($ch, [
        CURLOPT_RESOLVE => ["$host:443:{$ips[0]}"],      // connect to the address that was checked
        CURLOPT_PROTOCOLS => CURLPROTO_HTTPS,
        CURLOPT_FOLLOWLOCATION => false,                  // a redirect could point anywhere
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 5,
        CURLOPT_MAXFILESIZE => 2 * 1024 * 1024,
    ]);
    return curl_exec($ch) ?: throw new RuntimeException(curl_error($ch));
}

file:///etc/passwd                            Only https URLs are allowed
http://bookshelf.test/cover.png               Only https URLs are allowed
https://127.0.0.1/admin                       Address 127.0.0.1 is not public
https://169.254.169.254/latest/meta-data/     Address 169.254.169.254 is not public
https://[::1]/                                Address ::1 is not public
https://10.0.0.5/                             Address 10.0.0.5 is not public
https://localhost/                            Address 127.0.0.1 is not public

display_errors = Off              ; never show errors, paths and SQL to users
display_startup_errors = Off
log_errors = On                   ; log them instead
error_reporting = E_ALL
expose_php = Off                  ; no X-Powered-By: PHP/8.5.11 header
allow_url_include = 0             ; the default; never enable it
open_basedir = /srv/bookshelf:/tmp  ; file functions cannot leave these directories
disable_functions = exec,passthru,shell_exec,system,proc_open,popen   ; if the application does not need them
session.cookie_secure = 1
session.cookie_httponly = 1
session.use_strict_mode = 1

<?php
// php -d open_basedir=/w ...
var_dump(@file_get_contents('/etc/passwd'));   // bool(false)
echo error_get_last()['message'], "\n";        // file_get_contents(/etc/passwd): Failed to open stream: Operation not permitted
var_dump(strlen(file_get_contents('/w/pages/faq.php')));   // int(20): inside the allowed tree

<?php
declare(strict_types=1);

header("Content-Security-Policy: default-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'");
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');   // only meaningful over HTTPS
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: strict-origin-when-cross-origin');
header_remove('X-Powered-By');

Content-Security-Policy: default-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

$ composer audit
No security vulnerability advisories found.
$ composer audit --abandoned=report      # also list abandoned packages
No security vulnerability advisories found.