Security features

[peter279k]

As title, the security components is important to this framework.

According to the OWASP, we need to consider the following security issues:

• XSS.
• SQL injection.
• CSRF (it mentioned on issue CSRF Protection  #140).

[lablnet]

About

• XSS
  its already in input class you may see => https://github.com/zestframework/Zest_Framework/blob/master/src/Input/Input.php#L133

and CSRF and Sql injections need to implemented

[peter279k]

About

* XSS
  its already in input class you may see => https://github.com/zestframework/Zest_Framework/blob/master/src/Input/Input.php#L133

and CSRF and Sql injections need to implemented

@lablnet, thank you for your reply.

After tracing the code, it seems that using the htmlspecialchars to prevent the XSS attack.

Do you consider the htmlentities function?

Here is this function explanation:

This function is identical to htmlspecialchars() in all ways, except with htmlentities(), all characters which have HTML character entity equivalents are translated into these entities.

The htmlentities is more powerful than htmlspecialchars because it can help us to specify the character encoding during entities convertion.

[peter279k]

Please look at this reference to know the OWASP Top 10 security issues.

https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf

[lablnet]

About

* XSS
  its already in input class you may see => https://github.com/zestframework/Zest_Framework/blob/master/src/Input/Input.php#L133

and CSRF and Sql injections need to implemented

@lablnet, thank you for your reply.

After tracing the code, it seems that using the htmlspecialchars to prevent the XSS attack.

Do you consider the htmlentities function?

Here is this function explanation:

This function is identical to htmlspecialchars() in all ways, except with htmlentities(), all characters which have HTML character entity equivalents are translated into these entities.

The htmlentities is more powerful than htmlspecialchars because it can help us to specify the character encoding during entities convertion.

@peter279k thanks, yes you are right
5d6f25e
fixed

[lablnet]

Please look at this reference to know the OWASP Top 10 security issues.

https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf

yes sure i will take a look here thanks.