Ending Injection Vulnerabilities
summary
Shows concrete bugs: string concatenation into SQL and order‑by and image src exploits that let unions or onerror run, plus Twig and command‑line injection examples. Demonstrates a practical fix using literal-string checked by PHPStan and Psalm, cites Meta/Google precedents, and gives an is_literal function implementation and a working static‑analysis workflow that flags mistakes immediately; RFC effort fails politically but the prototype and webpages exist and the checks actually catch real issues.
AI-written summary · about
chapters (24)
- 0:00Injection vulnerabilities intro
- 1:08Escaping strings pitfalls
- 2:32Parameterized queries PHP
- 4:42ORM query builder risks
- 6:27SQL injection ORMs
- 7:10Laravel raw queries dangers
- 8:57Order by raw injection
- 11:26Exploiting order by clauses
- 13:16Direct SQL mistakes
- 13:59Doctrine query builder
- 16:07HTML templating injection
- 17:56Image JS injection
- 19:21Command line injection
- 20:04Taint checking limits
- 24:42Escaping context matters
- 26:07Trusted vs untrusted strings
- 29:18WHERE IN special cases
- 31:23Parameterized queries plans
- 32:46Field name injection
- 34:53Literal string types today
- 36:15Static analysis Psalm PHPStan
- 38:29Static analysis challenges
- 41:04PHP literal string proposal
- 43:10Summary call to action
related talks
48mEnding Injection Vulnerabilities
54mTaking on the King: Killing Injection Vulnerabilities
35mPHP is evil (Defensive programming)
34mBeating the pentester
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities
45mKnow Your Enemies: Live Exploit of a PHP Engine Security Breach
23mJavaScript attack surface
56mModern Web Vulnerabilities 2020