CI_Security Class Reference

Public Member Functions
	__construct ()
	csrf_verify ()
	csrf_set_cookie ()
	csrf_show_error ()
	get_csrf_hash ()
	get_csrf_token_name ()
	xss_clean ($str, $is_image=FALSE)
	xss_hash ()
	entity_decode ($str, $charset='UTF-8')
	sanitize_filename ($str, $relative_path=FALSE)

Protected Member Functions
	_compact_exploded_words ($matches)
	_remove_evil_attributes ($str, $is_image)
	_sanitize_naughty_html ($matches)
	_js_link_removal ($match)
	_js_img_removal ($match)
	_convert_attribute ($match)
	_filter_attributes ($str)
	_decode_entity ($match)
	_validate_entities ($str)
	_do_never_allowed ($str)
	_csrf_set_hash ()

Protected Attributes
	$_xss_hash = ''
	$_csrf_hash = ''
	$_csrf_expire = 7200
	$_csrf_token_name = 'ci_csrf_token'
	$_csrf_cookie_name = 'ci_csrf_token'
	$_never_allowed_str
	$_never_allowed_regex

Constructor & Destructor Documentation

__construct

(

)

Constructor

Returns

void

Member Function Documentation

_compact_exploded_words (   $matches)

protected

Compact Exploded Words

Callback function for xss_clean() to remove whitespace from things like j a v a s c r i p t

Parameters

type

Returns

type

_convert_attribute (   $match)

protected

Attribute Conversion

Used as a callback for XSS Clean

Parameters

array

Returns

string

_csrf_set_hash ( )

protected

Set Cross Site Request Forgery Protection Cookie

Returns

string

_decode_entity (   $match)

protected

HTML Entity Decode Callback

Used as a callback for XSS Clean

Parameters

array

Returns

string

_do_never_allowed (   $str)

protected

Do Never Allowed

A utility function for xss_clean()

Parameters

string

Returns

string

_filter_attributes (   $str)

protected

Filter Attributes

Filters tag attributes for consistency and safety

Parameters

string

Returns

string

_js_img_removal (   $match)

protected

JS Image Removal

Callback function for xss_clean() to sanitize image tags This limits the PCRE backtracks, making it more performance friendly and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in PHP 5.2+ on image tag heavy strings

Parameters

array

Returns

string

_js_link_removal (   $match)

protected

JS Link Removal

Callback function for xss_clean() to sanitize links This limits the PCRE backtracks, making it more performance friendly and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in PHP 5.2+ on link-heavy strings

Parameters

array

Returns

string

_sanitize_naughty_html (   $matches)

protected

Sanitize Naughty HTML

Callback function for xss_clean() to remove naughty HTML elements

Parameters

array

Returns

string

_validate_entities (   $str)

protected

Validate URL entities

Called by xss_clean()

Parameters

string

Returns

string

csrf_set_cookie

(

)

Set Cross Site Request Forgery Protection Cookie

Returns

object

csrf_show_error

(

)

Show CSRF Error

Returns

void

csrf_verify

(

)

Verify Cross Site Request Forgery Protection

Returns

object

entity_decode	(		$str,
			$charset = 'UTF-8'
	)

HTML Entities Decode

This function is a replacement for html_entity_decode()

The reason we are not using html_entity_decode() by itself is because while it is not technically correct to leave out the semicolon at the end of an entity most browsers will still interpret the entity correctly. html_entity_decode() does not convert entities without semicolons, so we are left with our own little solution here. Bummer.

Parameters

string
string

Returns

string

get_csrf_hash

(

)

Get CSRF Hash

Getter Method

Returns

string self::_csrf_hash

get_csrf_token_name

(

)

Get CSRF Token Name

Getter Method

Returns

string self::csrf_token_name

sanitize_filename	(		$str,
			$relative_path = FALSE
	)

Filename Security

Parameters

string
bool

Returns

string

xss_clean	(		$str,
			$is_image = FALSE
	)

XSS Clean

Sanitizes data so that Cross Site Scripting Hacks can be prevented. This function does a fair amount of work but it is extremely thorough, designed to prevent even the most obscure XSS attempts. Nothing is ever 100% foolproof, of course, but I haven't been able to get anything passed the filter.

Note: This function should only be used to deal with data upon submission. It's not something that should be used for general runtime processing.

This function was based in part on some code and ideas I got from Bitflux: http://channel.bitflux.ch/wiki/XSS_Prevention

To help develop this script I used this great list of vulnerabilities along with a few other hacks I've harvested from examining vulnerabilities in other programs: http://ha.ckers.org/xss.html

Parameters

mixed	string or array
bool

Returns

string

xss_hash

(

)

Random Hash for protecting URLs

Returns

string

Field Documentation

$_never_allowed_regex

protected

Initial value:

= array(
        'javascript\s*:',
        'expression\s*(\(|&\#40;)', 
        'vbscript\s*:', 
        'Redirect\s+302',
        "([\"'])?data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?"
    )

$_never_allowed_str

protected

Initial value:

= array(
        'document.cookie'   => '[removed]',
        'document.write'    => '[removed]',
        '.parentNode'       => '[removed]',
        '.innerHTML'        => '[removed]',
        'window.location'   => '[removed]',
        '-moz-binding'      => '[removed]',
        '<!--'              => '&lt;!--',
        '-->'               => '--&gt;',
        '<![CDATA['         => '&lt;![CDATA[',
        '<comment>'         => '&lt;comment&gt;'
    )

---

The documentation for this class was generated from the following file:

• system/core/Security.php