哪些$ _SERVER变量是安全的? [英] Which $_SERVER variables are safe?

问题描述

用户可以控制的任何变量，攻击者也可以控制，因此是攻击的源头.这被称为污染"变量，并且是不安全的.

Any variable that a user can control, an attacker can also control and is therefore a source of an attack. This is called a "tainted" variable, and is unsafe.

使用 $_SERVER 时，许多变量可以是受控.客户端发送的HTTP请求标头中的PHP_SELF，HTTP_USER_AGENT，HTTP_X_FORWARDED_FOR，HTTP_ACCEPT_LANGUAGE等.

有人知道$_SERVER变量的安全列表"或无污染列表吗?

Does anyone know of a "safe list" or untainted list of $_SERVER variables?

推荐答案

没有这样的安全"或不安全"值.只有服务器控制的值和用户控制的值，您需要知道值来自何处，因此是否可以出于特定目的信任该值.例如，$_SERVER['HTTP_FOOBAR']完全安全地存储在数据库中，但是我很肯定不会eval它.

There's no such thing as "safe" or "unsafe" values as such. There are only values that the server controls and values that the user controls and you need to be aware of where a value comes from and hence whether it can be trusted for a certain purpose. $_SERVER['HTTP_FOOBAR'] for example is entirely safe to store in a database, but I most certainly wouldn't eval it.

这样，让我们​​将这些值分为三类:

As such, let's divide those values into three categories:

这些变量由服务器环境设置，并且完全取决于服务器配置.

These variables are set by the server environment and depend entirely on the server configuration.

• 'GATEWAY_INTERFACE'
• 'SERVER_ADDR'
• 'SERVER_SOFTWARE'
• 'DOCUMENT_ROOT'
• 'SERVER_ADMIN'
• 'SERVER_SIGNATURE'

• 'GATEWAY_INTERFACE'
• 'SERVER_ADDR'
• 'SERVER_SOFTWARE'
• 'DOCUMENT_ROOT'
• 'SERVER_ADMIN'
• 'SERVER_SIGNATURE'

这些变量取决于客户端发送的特定请求，但只能采用有限数量的有效值，因为所有无效值都应由Web服务器拒绝，并且不会导致脚本的调用开始.因此，可以将其视为可靠.

These variables depend on the specific request the client sent, but can only take a limited number of valid values, since all invalid values should be rejected by the web server and not cause the invocation of the script to begin with. Hence they can be considered reliable.

• 'HTTPS'
• 'REQUEST_TIME'
• 'REMOTE_ADDR' *
• 'REMOTE_HOST' *
• 'REMOTE_PORT' *
• 'SERVER_PROTOCOL'
• 'HTTP_HOST'†
• 'SERVER_NAME'†
• 'SCRIPT_FILENAME'
• 'SERVER_PORT'‡
• 'SCRIPT_NAME'

• 'HTTPS'
• 'REQUEST_TIME'
• 'REMOTE_ADDR' *
• 'REMOTE_HOST' *
• 'REMOTE_PORT' *
• 'SERVER_PROTOCOL'
• 'HTTP_HOST' †
• 'SERVER_NAME' †
• 'SCRIPT_FILENAME'
• 'SERVER_PORT' ‡
• 'SCRIPT_NAME'

*经TCP/IP握手验证，确保REMOTE_值是客户端的有效地址.这是将任何响应发送到的地址.但是REMOTE_HOST依赖于反向DNS查找，因此可能会受到对您的服务器的DNS攻击的欺骗(在这种情况下，无论如何您都会遇到更大的问题).该值可能是代理，这是TCP/IP协议的简单现实，您无能为力.

* The REMOTE_ values are guaranteed to be the valid address of the client, as verified by a TCP/IP handshake. This is the address where any response will be sent to. REMOTE_HOST relies on reverse DNS lookups though and may hence be spoofed by DNS attacks against your server (in which case you have bigger problems anyway). This value may be a proxy, which is a simple reality of the TCP/IP protocol and nothing you can do anything about.

†如果您的Web服务器响应 any 请求而与HOST标头无关，那么这也应被认为是不安全的.请参见 $ _SERVER ["HTTP_HOST"]有多安全?.
另请参见 http://shiflett.org/blog/2006/mar /server-name-versus-http-host .

† If your web server responds to any request regardless of HOST header, this should be considered unsafe as well. See How safe is $_SERVER["HTTP_HOST"]?.
Also see http://shiflett.org/blog/2006/mar/server-name-versus-http-host.

‡请参见 https://bugs.php.net/bug.php?id= 64457 ， http://httpd.apache.org/docs /current/mod/core.html#usecanonicalphysicalport ， http: //httpd.apache.org/docs/2.4/mod/core.html#comment_999

这些值根本不会检查，也不依赖于任何服务器配置，它们完全是客户端发送的任意信息.

These values are not checked at all and do not depend on any server configuration, they are entirely arbitrary information sent by the client.

• 'argv'，'argc'(仅适用于CLI调用，通常不涉及Web服务器)
• 'REQUEST_METHOD'§
• 'QUERY_STRING'
• 'HTTP_ACCEPT'
• 'HTTP_ACCEPT_CHARSET'
• 'HTTP_ACCEPT_ENCODING'
• 'HTTP_ACCEPT_LANGUAGE'
• 'HTTP_CONNECTION'
• 'HTTP_REFERER'
• 'HTTP_USER_AGENT'
• 'AUTH_TYPE'‖
• 'PHP_AUTH_DIGEST'‖
• 'PHP_AUTH_USER'‖
• 'PHP_AUTH_PW'‖
• 'PATH_INFO'
• 'ORIG_PATH_INFO'
• 'REQUEST_URI'(可能包含污染数据)
• 'PHP_SELF'(可能包含污染数据)
• 'PATH_TRANSLATED'
• 任何其他'HTTP_'值

• 'argv', 'argc' (only applicable to CLI invocation, not usually a concern for web servers)
• 'REQUEST_METHOD' §
• 'QUERY_STRING'
• 'HTTP_ACCEPT'
• 'HTTP_ACCEPT_CHARSET'
• 'HTTP_ACCEPT_ENCODING'
• 'HTTP_ACCEPT_LANGUAGE'
• 'HTTP_CONNECTION'
• 'HTTP_REFERER'
• 'HTTP_USER_AGENT'
• 'AUTH_TYPE' ‖
• 'PHP_AUTH_DIGEST' ‖
• 'PHP_AUTH_USER' ‖
• 'PHP_AUTH_PW' ‖
• 'PATH_INFO'
• 'ORIG_PATH_INFO'
• 'REQUEST_URI' (may contain tainted data)
• 'PHP_SELF' (may contain tainted data)
• 'PATH_TRANSLATED'
• any other 'HTTP_' value

§是可靠的.

§ May be considered reliable as long as the web server allows only certain request methods.

可靠.

超全局$_SERVER还包括几个环境变量.这些是否安全"取决于它们的定义方式(和位置).它们的范围从完全由服务器控制到完全由用户控制.

The superglobal $_SERVER also includes several environment variables. Whether these are "safe" or not depend on how (and where) they are defined. They can range from completely server controlled to completely user controlled.

这篇关于哪些$ _SERVER变量是安全的?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！