Thoughts? I tested this with some example XSS attacks and all were escaped correctly. Just trying to think of a specific-use case with the above that is no longer caught
Potential security concerns on custom pagination
Hello,
I've extended the LengthAwarePaginator class to allow for multiple parameters of the same name.
http://localhost:8000/api/examples?q=hello&q=test
With LengthAwarePaginator it returns the following for nextPageUrl & prevPageUrl
nextPageUrl: http://localhost:8000/api/examples?q%5B0%5D=hello&q%5B1%5D=test&page=3
prevPageUrl: http://localhost:8000/api/examples?q%5B0%5D=hello&q%5B1%5D=test&page=1
I overrided the member function url() that is on the AbstractPaginator class to this
/**
* Get the URL for a given page number.
*
* @param int $page
* @return string
*/
public function url($page)
{
if ($page <= 0) {
$page = 1;
}
// If we have any extra query string key / value pairs that need to be added
// onto the URL, we will put them in query string form and then attach it
// to the URL. This allows for extra information like sortings storage.
$parameters = [$this->pageName => $page];
if (count($this->query) > 0) {
$parameters = array_merge($this->query, $parameters);
}
$query = http_build_query($parameters, '', '&');
$query = preg_replace('/%5B[0-9]+%5D/simU', '', $query);
return $this->path
.(Str::contains($this->path, '?') ? '&' : '?')
.$query
.$this->buildFragment();
}
The only thing I changed was the following section with the call to http_build_query()
$query = http_build_query($parameters, '', '&');
$query = preg_replace('/%5B[0-9]+%5D/simU', '', $query);
return $this->path
.(Str::contains($this->path, '?') ? '&' : '?')
.$query
.$this->buildFragment();
Basically, I'm just searching for whenever the query includes the following characters and replaces it with an empty string like so:
%5B0%5D => ''
And eureka! It works, I'm now getting the correct next and prev pages for the paginator.
However, I'm wondering if there are any security concerns with doing this. If I always replace any occurrence of...
%5B0%5D
Am I opening up myself to security holes or XSS attacks?
Thanks for any help you can provide.
Please or to participate in this conversation.