Comments (6)
Where exactly is the security problem here?
from geshi-1.0.
maybe substr(0,4) from md5(randomstuff) is too predictible, doesn't this let us with something like 36^4 possibility "only"??? https://phpsecurity.readthedocs.io/en/latest/Insufficient-Entropy-For-Random-Values.html
and i found http://php.net/manual/fr/function.microtime.php#101561
While doing some experiments on using microtime()'s output for an entropy generator I found that its microsecond value was always quantified to the nearest hundreds (i.e. the number ends with 00), which affected the randomness of the entropy generator.
from geshi-1.0.
And where exactly is a random HTML id attribute a security problem?
from geshi-1.0.
md5(microtime()) This function uses the !php_standard_ns.md5() function, which uses a hash algorithm that is considered weak. In recent years, researchers have demonstrated ways to breach many uses of previously-thought-safe hash functions such as MD5.
from geshi-1.0.
- you provided evidence that a not-so-secure ID attribute is a security risk
- you understand the problem
from geshi-1.0.
The provided algorithm is for generating a set of random IDs in case where the user does not provide a custom one, but where still the code needs to generate some (somewhat) unique ID. As the ID is truncated to be short even using something "more secure" like SHA-256 or Keccak won't solve the problem of collissions. The only solution really fixing the issue would be for the user of the library to provide GeSHi with a guaranteed-random base ID. In absence of a guaranteed-unique value provided by the caller, reasonably trying to generate something random is sufficient (and NOT a security issue); i.e. the worst that can happen is the UA rendering the returned string switching to Quirks Mode due to duplicated generated IDs in the document.
from geshi-1.0.
Related Issues (20)
- TWIG templating HOT 1
- New release tag HOT 8
- Support Json format HOT 10
- scilab highlighting has not valid html links HOT 1
- scilab highlighting refers old docs HOT 3
- <CODE SAS> highlighting inside PROC SQL HOT 5
- Deprecated: Function create_function() is deprecated HOT 1
- Use keyword parser control for roff
- 'Perl 6' has been renamed as 'Raku'
- Website out of date
- Please repair qbnz.com
- Typo in Swift keyword
- Add synonyms for conventional well-known languages/extensions
- TSQL syntax highlighing error HOT 1
- Case sensitivity & array index
- Php8.1 brokes
- Go highlighting borks on numbers HOT 3
- qbnz.com down
- Thank You
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from geshi-1.0.