Mixing
Security issue in Code Igniter Loader.php file by using eval() method
In codeignite3 for Loader.php file, eval() is being used like this:
echo eval('?>'.preg_replace('/;*s*?>/', '; ?>', str_replace('<?=', '<?php echo ', file_get_contents($_ci_path))));
This call to eval() contains untrusted input. If this input could be modified by an attacker, arbitrary PHP code could be executed on the server. The first argument to phpeval() contains data from the incoming HTTP request. The data from the incoming HTTP request originated from an earlier call to file_get_contents.
Can we not use Eval and use any other mencahnism???
php codeigniter-3
asked Jan 2 at 5:10
ROHIT BANSALROHIT BANSAL
83
add a comment |
In codeignite3 for Loader.php file, eval() is being used like this:
echo eval('?>'.preg_replace('/;*s*?>/', '; ?>', str_replace('<?=', '<?php echo ', file_get_contents($_ci_path))));
This call to eval() contains untrusted input. If this input could be modified by an attacker, arbitrary PHP code could be executed on the server. The first argument to phpeval() contains data from the incoming HTTP request. The data from the incoming HTTP request originated from an earlier call to file_get_contents.
Can we not use Eval and use any other mencahnism???
php codeigniter-3
asked Jan 2 at 5:10
ROHIT BANSALROHIT BANSAL
83
It's good you recognized that eval was being used and that it is a risk. Generally if eval is being used the logic of the code is flawed at some level. On another note even some preg functions ultimately resolve to eval being used. Always sanitize and find another way. I'm not familiar with codeignitor enough to help you though.
– Joseph_J
Jan 2 at 5:59
add a comment |
In codeignite3 for Loader.php file, eval() is being used like this:
echo eval('?>'.preg_replace('/;*s*?>/', '; ?>', str_replace('<?=', '<?php echo ', file_get_contents($_ci_path))));
This call to eval() contains untrusted input. If this input could be modified by an attacker, arbitrary PHP code could be executed on the server. The first argument to phpeval() contains data from the incoming HTTP request. The data from the incoming HTTP request originated from an earlier call to file_get_contents.
Can we not use Eval and use any other mencahnism???
php codeigniter-3
asked Jan 2 at 5:10
ROHIT BANSALROHIT BANSAL
83
In codeignite3 for Loader.php file, eval() is being used like this:
echo eval('?>'.preg_replace('/;*s*?>/', '; ?>', str_replace('<?=', '<?php echo ', file_get_contents($_ci_path))));
This call to eval() contains untrusted input. If this input could be modified by an attacker, arbitrary PHP code could be executed on the server. The first argument to phpeval() contains data from the incoming HTTP request. The data from the incoming HTTP request originated from an earlier call to file_get_contents.
Can we not use Eval and use any other mencahnism???
php codeigniter-3
php codeigniter-3
asked Jan 2 at 5:10
ROHIT BANSALROHIT BANSAL
83
asked Jan 2 at 5:10
ROHIT BANSALROHIT BANSAL
83
asked Jan 2 at 5:10
ROHIT BANSALROHIT BANSAL
83
asked Jan 2 at 5:10
ROHIT BANSALROHIT BANSAL
83
asked Jan 2 at 5:10
ROHIT BANSALROHIT BANSAL
83
83
It's good you recognized that eval was being used and that it is a risk. Generally if eval is being used the logic of the code is flawed at some level. On another note even some preg functions ultimately resolve to eval being used. Always sanitize and find another way. I'm not familiar with codeignitor enough to help you though.
– Joseph_J
Jan 2 at 5:59
add a comment |
It's good you recognized that eval was being used and that it is a risk. Generally if eval is being used the logic of the code is flawed at some level. On another note even some preg functions ultimately resolve to eval being used. Always sanitize and find another way. I'm not familiar with codeignitor enough to help you though.
– Joseph_J
Jan 2 at 5:59
It's good you recognized that eval was being used and that it is a risk. Generally if eval is being used the logic of the code is flawed at some level. On another note even some preg functions ultimately resolve to eval being used. Always sanitize and find another way. I'm not familiar with codeignitor enough to help you though.
– Joseph_J
Jan 2 at 5:59
It's good you recognized that eval was being used and that it is a risk. Generally if eval is being used the logic of the code is flawed at some level. On another note even some preg functions ultimately resolve to eval being used. Always sanitize and find another way. I'm not familiar with codeignitor enough to help you though.
– Joseph_J
Jan 2 at 5:59
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54001486%2fsecurity-issue-in-code-igniter-loader-php-file-by-using-eval-method%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54001486%2fsecurity-issue-in-code-igniter-loader-php-file-by-using-eval-method%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
It's good you recognized that eval was being used and that it is a risk. Generally if eval is being used the logic of the code is flawed at some level. On another note even some preg functions ultimately resolve to eval being used. Always sanitize and find another way. I'm not familiar with codeignitor enough to help you though.
– Joseph_J
Jan 2 at 5:59