PHP: Security when using CURL?

Question

I have a page like this. User write an URL into a form and submit. Once the URL is submitted, I connect that page with CURL, search for a string. If it finds the string, it adds URL into our database. If not, it gives an error to user.

I sanitize URL with htmlspecialchars() also a regex to allow A-Z, 1-9, :/-. symbols. I also sanitize the content retrieved from other website with htmlspecialchars() also.

My question is, can they enter an URL like; www.evilwebsite.com/shell.exe or shell.txt

Would PHP run it, or simply look for the HTML output? Is it safe as it is or if not, what should I do?

Thank you.

Ps. allow_url_fopen is disabled. That's why I use curl.

Niklas B. · Accepted Answer · 2012-02-28 03:15:55Z

5

I don't see why htmlspecialchars or a Regex would be necessary here, you don't need those. Also, there is no way that PHP will "automatically" parse the content retrieved using cURL. So yes, it is save (unless you do stuff like eval with the output).

However, when processing the retrieved content later, be aware that the input is user-provided and needs to be handled accordingly.

answered Feb 28, 2012 at 3:15

Niklas B.

95.8k18 gold badges201 silver badges228 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Aristona Over a year ago

Actually, the only thing I do with the retrieved content is doing a basic regex scan. For example, if the retrieved content contains a "Hello" text anywhere, it will insert the URL into database. If not, it will error user like "Hello text is not found in this page." Is there any steps I should take while scanning for "Hello" text?

Niklas B. Over a year ago

@AnılÜnal: No, that's perfectly secure. But you should still drop that unnecessary sanitization, it could break certain URLs and cause denial of service.

Francois Bourgeois Over a year ago

htmlspecialchars() does not save you from the eval eye :-) I think his point was to prevent XSS.

Patrick Lorio · Accepted Answer · 2012-02-28 03:16:50Z

1

curl makes a request and to a server and the server sends back data. If there were an executable file on a web server you'd get back the binary of the file. Unless you write the file to your disk and execute it there should be no problem. Security in that sense should not be an issue.

answered Feb 28, 2012 at 3:16

Patrick Lorio

5,66812 gold badges49 silver badges75 bronze badges

3 Comments

Jonathon Reinhart Over a year ago

Unless you find some vulnerability in the version of cURL the server is using or the PHP script parsing it, at which point you have complete control of the data going to it (if you host the provided URL )

Patrick Lorio Over a year ago

Well what you do with the data can cause security flaws but cURL should not. The only vulnerability I can think of is buffer overflows, but PHP handles and protects against that. What sort of vulnerabilities are you thinking about?

Niklas B. Over a year ago

@Patrick: PHP handles and protects against that? That's news to me. Also, there exist plenty other types of vulnerabilities, especially in software like PHP. But that's not actually relevant to the question, as you can't do much against that risk short of sandboxing your web-server.

Collectives™ on Stack Overflow

PHP: Security when using CURL?

2 Answers 2

3 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related