Ki te whakamahi koe rīpene hei horoi i ngā tāurunga a te kaiwhakamahi, ehara i te mea ko koe anake. He maha ngā kaiwhakawhanake e whakawhirinaki ana ki tēnei momo te horoinga whakauru hei aukati i ngā nganatanga werohanga. I te tirohanga tuatahi, he mea tika te tango i ngā pūāhua kino, ā, ka ngaro te kawenga. Heoi, ka puta he whakaaro teka mō te haumaru i tēnei huarahi. Inaa, ka taea e ngā kaiwhakaeke te karo i ngā tātari ngāwari pēnei i te rīpene te whakamahi i ngā kawenga kua whakapōreareatia, ngā whakakōwae, te whakawhiti horopaki mohio rānei. Koia te take kāore ngā kaiwhakawhanake mohio e mutu i reira. Engari, ka whakamahia e rātou nga uiui tawhā, e ārai ana i ngā whakaeke werohanga ki te pūtake.
I roto i tēnei pou, ka ako koe i te take rīpene kāore e angitu i roto i ngā horopaki o te ao tūturu, me pēhea te whakamahi kino a ngā kaiwhakaeke i ēnei tātari, me ngā huarahi haumaru e mahi ana. Ka tirotirohia e mātou ngā tauira waehere, ka whakaaturia ngā tikanga karo noa, ā, ka whakamāramahia me pēhea te horoinga whakauru me hono tonu ki ngā parenga hanganga pēnei i nga uiui tawhā, ki te kore ka noho ngoikore tonu koe.
He aha rīpene E mahi ana (me te kore)
He maha ngā kaiwhakawhanake e whakamahi ana stripchar ngā mahi rite rānei hei tango i ngā pūāhua haumaru kore mai i te whakaurunga a te kaiwhakamahi. I te nuinga o te wā, ka tangohia e ia ngā tohutō, ngā tohu motuhake, ngā mea rānei ehara i te tau ā-reo. I te tuatahi, he rite te ahua o tēnā te horoinga whakauru, engari ehara i te mea he parenga tūturu.
Me wehewehe tātou. He mahi pēnei:
ka tangohia ngā pūāhua pērā i ', ", ranei ;. Nō reira, ki te whakauru koe:
Ka huri hei:
Ahakoa te āhua ma o te whakaurunga a te kaiwhakamahi, ka taea tonu e ngā kaiwhakaeke te wero i ngā kawenga SQL mā te whakamahi i te arorau anake, inā koa ka hangaia e te tono ngā patai mā te honohono aho. Hei ārai pono i te werohanga SQL, me whakamahi koe i ngā patai kua whakawhāitihia te tawhā me te whakahaere whakauru e mōhio ana ki te horopaki. Ngā tātari pūāhua pēnei i stripchar() kāore i te rawaka.
Ae, tera pea he āhua haumaru ake te whakaurunga kua tangohia i te tirohanga tuatahi. Heoi, kāore tēnei huarahi e whakakore i ngā whakaaro kino, engari ka whakarerekē noa i te āhua o te tuhi. Inaa, he maha ngā wā ka whakamahia e ngā kaiwhakaeke tēnei mā te whakawaehere i ngā kawenga, te whakauru i te mokowā mā, te whakamahi rautaki rānei i ngā tohu kua tangohia hei karo katoa i tō tātari.
Haunga, rīpene kāore he horopaki whakahirahira. Kāore e mōhiotia ana mēnā kei te anga te tāuru ki tētahi pātengi raraunga, ki tētahi anga, ki tētahi pūtirotiro rānei. Ko te tikanga, kāore e taea e ia te whakamahi i te mawhiti tika, i te whakawaehere rānei. Ko te horoi i te tāuru me te kore e mōhio ki te ūnga he rite ki te mawhiti i te HTML i te mea kei te tūpono te riri tūturu. SQLi.
I te mutunga, rīpene Kāore e whakamārama, e tiaki rānei i tetahi mea, engari ka whakatika noa i ngā aho. Ā, ehara te whakatika i te haumarutanga. Ki te hiahia koe ki te tiakitanga tūturu, whakamahia ngā patai hanganga, whakamanahia, me ngā patai tawhā. He tohu mutu.
Hei whakamārama i te rerekētanga, anei te whakataurite taha-ki-taha o stripchar ki ngā patai kua whakarārangihia:
Ngā Uiui Stripchar me ngā Uiui Kua Whakatakotorangia: Ko tēhea te mea e tiaki ana i tō waehere?
| Āhuahira | stripchar() | Ngā Uiui Kua Whakatakotoria he Tawhā |
|---|---|---|
| Taumata Parenga | Te horoi aho taketake. He ngāwari te karo mā te whakamahi i ngā mahi tinihanga waehere, ngā mahi arorau rānei. | He parenga kaha ki ngā momo werohanga SQL katoa. |
| Horopaki Maharahara | Kāore e aro ki ngā horopaki (SQL, HTML, shell, me ētahi atu). Ka whakamahia te ture kotahi ki ngā wāhi katoa. | Mārama katoa ki te horopaki. Ka whakamahia te mawhiti tika mō ia taiao. |
| Ngā Mahi a te Kaiwhakawhanake | He tere te whakatinanatanga engari kāore e pono mō te whakamahinga roa. | Me tika te whakaurunga, engari he pakari, ā, he pai mō ngā rā kei te heke mai. |
| Ātete Ārai | Iti — ka ngāwari te urutau a ngā kaiwhakaeke mā te whakamahi i te mokowā mā, te waehere, te arorau rānei. | Teitei — ka wehe i te waehere mai i te raraunga, ka ārai pono hoki i te werohanga. |
| Te Whakawhirinakitanga ki te Haumarutanga | Te whakaaro teka mō te haumaru — tērā pea ka hunaia te raruraru me te kore e whakatika. | Ahumahi pono standard mō te whakahaerenga patai haumaru. |
Te Āhua o te Karo i te Whakamaemaetanga Whakauru a ngā Kaiwhakaeke
Koinei te āhua o tētahi rerenga ngoikore noa ina whakawhirinaki ngā kaiwhakawhanake ki rīpene mō te horoi i ngā whakaurunga:
Kāore e hiahiatia ana e ngā kaiwhakaeke te pakaru i ō tātari, me mahi noa rātou haere a tawhio noa i a rātou. Ina whakawhirinaki ngā kaiwhakawhanake ki rīpene mō te horoi i ngā tāurunga, e whakaaro ana rātou mā te tango i ngā tohu pēnei i ngā tohutō, ngā tohukōrero rānei ka aukati i ngā ngana werohanga. Heoi, ka tere te urutau o ngā kaiwhakaeke. Ka hangaia e rātou ngā kawenga kua whakapōreareatia e paheke ana i roto i ngā tātari regex, inā koa ka kore he horopaki o aua tātari.
Hei tauira, me kī atu ka ngana koe ki te horoi i te whakaurunga penei:
Ahakoa kāore e taea e te kaiwhakamahi te tuku i tētahi tuhinga tawhito ' OR 1=1 --, ka taea e rātou te whakamahi i ngā mahi tinihanga Unicode, te honohono aho, te wetereo pakaru rānei e rere tonu ana. He maha ngā wā ka mahi ngā kawenga pēnei:
ranei:
Ki te tangohia e tō mahi ngā pūāhua ehara i te kupu, ka taea e koe hanga anō i tētahi whakahau SQL tika i runga i te tūponoKo te mea kino rawa atu, ka taea e ngā kaiwhakaeke te whakakōwae i ngā uara i roto i ngā huarahi e whiti ana i tō tātari engari ka wetewetehia e te pūnaha ūnga.
Haunga te werohanga SQL, rīpene kāore e rahua i roto i ētahi atu horopaki, pērā i ngā whakahau anga, ngā ara kōnae, tae noa ki te whakahaerenga JavaScript. Nā te mea kāore e mōhio ki te wāhi e whakamahia ai te tāuru, kāore e taea te whakamahi i te mawhiti tika, te whakamana rānei.
Ko te mutunga, te horoinga whakauru mā te rīpene he ngāwari te karo. Ko te haumarutanga tūturu ka puta mai i ngā mana whakahaere e mōhio ana ki te horopaki, rawa nga uiui tawhā e ārai katoa ana i te werohanga arorau.
He aha me whakamahi ai koe i ngā pātai kua whakarārangihia te tawhā
Ki te hiahia koe ki te aukati i ngā whakaeke werohanga, me mahi koe i tēnei kati te hanga uiui me ngā aho. Kei kona tena nga uiui tawhā tomo mai. Kāore i rite ki rīpene, kāore rātou e tātari, rātou wehea te waehere mai i te raraunga i te taumata miihini.
Me tirotiro anō tātou i te patai pakaru:
He mea morearea tēnei nā te mea ka werohia tika te tāuru ki roto i te SQL. Ahakoa te tango i ngā pūāhua, kei te hanga tonu koe i tētahi aho ka taea te whakamahi hē. Engari, whakamahia he patai kua whakarārangihia pēnei:
I konei, e mōhio ana te taraiwa pātengi raraunga userInput he raraunga, waehere kāore e taea te whakahaere. Ka mawhiti aunoa mai i reira, ka aukati i te weronga, ahakoa kei roto i te tāuru he tohutō, he tohupiko, he utunga whakakōnae-hex rānei.
I roto i te Python:
I roto i te PHP me te PDO:
I roto i ēnei tauira katoa, nga uiui tawhā ārai i te werohanga me te kore e hiahia ki te matapae ko ēhea ngā tohu ka kino pea. Kāore koe e hiahia rīpene me whai hanganga pātai whai kiko, e mārama ana ki te horopaki.
Hei tāpiritanga, ka āraihia e tēnei tikanga ngā kawenga kua huna, ngā mahi tinihanga Unicode, me ngā arai whakawaehere, arā, ngā tauira karo i kitea i roto i Ngā ngoikoretanga o te XSSKa hopu wawetia ēnei tūmomo riri e ngā taputapu pērā i a Xygeni. SAST tātari.
I roto i te poto, kāore ngā parepare tūturu e whakawhirinaki ki ngā tātari. E whakawhirinaki ana rātou ki ngā kawa, ki ngā API pono, me te horopaki katoa. Ki te whakamahi koe i ngā anga mahi, i te werohanga ratonga hihiri rānei, kia mōhio ki te horapa o ngā tāurunga mā roto i tō pūtake waehere. Werohanga whakawhirinakitanga haumaru kia kore ai ngā rerenga uaua e whakatuwhera i ngā mata whakaeke hou.
Kaua e whakawhirinaki ki rīpeneWhakamahia a Xygeni hei Whakaū i ngā Parenga Tuturu
Ahakoa ka whakamahia e koe nga uiui tawhā, kāore he taurangi ka whai tō pūnaha waehere katoa i te mea kotahi standardKa taea tonu e te arorau tawhito, ngā tuhinga a te hunga tuatoru, ngā rārangi kua warewarehia rānei i roto i te PR te whakauru i ngā mōrearea werohanga. Koinei tonu te wāhi e āwhina ai a Xygeni.
Ka matawai a Xygeni i tō waehere pūtake, pull requests, me te CI pipelinehei hopu:
- Ngā aho patai e hanga ana i te SQL me te honohono
- Ngā tātari ngoikore, ngā tātari ā-whare rānei pērā i rīpene
- He arorau whakapae e ōrite ana ki ngā kawenga kua whakapōreareatia e mōhiotia ana
Kāore koe e hiahia ki te tirotiro i ngā rārangi katoa. Ka tohua wawetia e Xygeni ngā tauira mōrearea, ā, ka pāngia. Whakatika Aunoa mēnā ka taea, ā, ka taea te aukati i ngā hanumitanga mōrearea me ngā mea ka taea te whakarite Guardrails.
I te poto, Ka whakarite a Xygeni ehara ngā patai kua whakarārangihia i te mahi pai noa iho, engari ka whakatinanahia i te tauine nui. Kāore he whakaaro noa iho. Kāore he tātari ngaro. He tiakitanga tūturu noa iho.
Kei te hiahia koe ki te kite me pēhea te kimi a Xygeni i ngā patai kore haumaru i roto i tō waehere?
Ngā Kōrero Matua: Ngā Mea hei Mahara rīpene me ngā Mōrearea Werohanga
- rīpene ehara i te mahi haumarutanga — ka tangohia ngā pūāhua, ehara i te mōrearea.
- Kāore i te rawaka te horoi i ngā tāuru ina hanga ana koe i ngā patai me te honohono aho.
- Ko ngā patai kua whakawhāitihia te parenga tika, ā, e tautokona ana e ngā reo, e ngā anga hou katoa.
- Ka taea e ngā kawenga kua whakapōrearea te paheke atu i ngā tātari, inā koa mēnā he mahi tinihanga kei roto.
- Tātaritanga pumau (SAST) ka hopukina e ngā taputapu ngā mea e ngaro ana i te tangata, tae atu ki ngā tauira kore haumaru e huna ana i roto i te waehere tawhito.
- Ka aunoa a Xygeni i te kimi, te whakarite i ngā mea matua, tae atu ki te whakatikatika kia taea ai e tō tīma te arotahi ki te tuhi āhuatanga, kaua ki te whai i ngā ngoikoretanga.
Whakatau: Kaua e Whakawhirinaki ki ngā Tātari. He mea Hangaia kia Haumaru.
Te whakawhirinaki ki ngā mahi penei i te rīpene Ahakoa he tere te ahua, he āhua haumaru te āhua. He tere ake te whanaketanga o ngā kaiwhakaeke i ngā tātari aho. Ko te huarahi pono anake hei aukati i ngā whakaeke werohanga ko te tuhi waehere haumaru mā te hoahoa, me te whakamana i taua hoahoa ki ngā wāhi katoa.
Mā ngā taputapu pēnei i a Xygeni koe e āwhina ki te mahi aunoa i tēnā. Mai i pull request Tuhinga o mua pipeline, ka hopukina e rātou ngā mea kāore e taea e ō tātari, ā, ka whakatikahia i mua i te taenga ki te whakaputanga.
