CodeIgniter
CodeIgniter copied to clipboard
bcit-ci
Update Exceptions.php
In some cases, error messages could lead to Cross-Site Scripting vulnerability. This small fix sanitize potential user input from GET/POST parameters that could be returned into error messages.
For example with this kind of code:
if (isset($_GET['page'])) { $this->load->view($_GET['page']); }
If the page is load with /?page= the JavaScript will be executed.
Why would you pass $_GET['page'] raw variable? We have a dedicated library for fetching GET parameters.
The example is not my code but something I saw during a security review.
Furthermore, by using the dedicated library, the injection on error page seems to still be possible. Indeed, the documentation from your link is saying that " XSS escaping should be performed on output, not input!".