Author: pwang
Date: 2013-02-13 16:42:46 -0800 (Wed, 13 Feb 2013)
New Revision: 31116
Modified:
new_cytoscape_website/bugreport/bugreport.php
Log:
Try to prevent JSON injection attack
Modified: new_cytoscape_website/bugreport/bugreport.php
===================================================================
--- new_cytoscape_website/bugreport/bugreport.php 2013-02-09 06:44:35 UTC
(rev 31115)
+++ new_cytoscape_website/bugreport/bugreport.php 2013-02-14 00:42:46 UTC
(rev 31116)
@@ -159,8 +159,8 @@
"{
\"issue\": {
\"project_id\": \"cytoscape3\",
- \"subject\": \"".$bugReport['cysubject']."\",
- \"description\": \"".$description."\"
+ \"subject\":
\"".clean_unwanted_characters($bugReport['cysubject'])."\",
+ \"description\":
\"".clean_unwanted_characters($description)."\"
}
}";
@@ -174,7 +174,21 @@
}
+// To prevent JSON injection attack
+function clean_unwanted_characters($oneStr){
+ $cleaned_str = str_ireplace("\"", "/", $oneStr);
+ $cleaned_str = str_ireplace("\\", "/", $cleaned_str);
+ $cleaned_str = str_ireplace("\\b", " ", $cleaned_str);
+ $cleaned_str = str_ireplace("\\f", " / ", $cleaned_str);
+ $cleaned_str = str_ireplace("\\r", " / ", $cleaned_str);
+ $cleaned_str = str_ireplace("\t", " ", $cleaned_str);
+ $cleaned_str = str_ireplace("\\u", " ", $cleaned_str);
+ $cleaned_str = str_ireplace("</", "<\/", $cleaned_str);
+
+ return $cleaned_str;
+}
+
function isUserInputValid($userInput) {
if ($userInput == NULL){
return false;
--
You received this message because you are subscribed to the Google Groups
"cytoscape-cvs" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/cytoscape-cvs?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.
