create account

RE: Deleted by jamzed

View this thread on: hive.blogpeakd.comecency.com

Viewing a response to: @moisesmcardona/steemapi-php-python-open-source

· @jamzed ·
Hey!

I'm not PHP expert, but I think steemapi-php API has a huge security breach...

example code: https://github.com/moisesmcardona/steemapi-php-python/blob/master/steemapi-php/getFollowingCount/index.php

```
<?php
header("Content-Type: text/plain");
$account = $_GET['a'];
setlocale(LC_ALL, 'en_US.utf8');
putenv('LC_ALL=en_US.utf8');
echo(exec("python3 ../../steemapi-python/getFollowingCount.py $account"));
?>
```
&nbsp;
Using exec calls is terrible idea when Steemit's API is available thru RPC/JSON calls and what is much much more dangerous, the above example code allows to inject any Bash command to run...  

```
index.php?a=jamzed;rm -rf/
```
&nbsp;
Please consider switching to Curl instead of running Python script and also please escape all input from users :)

You can find a lot of information how to make your code more secure on [Owasp Top 10](https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project) page.
👍  
properties (23)
authorjamzed
permlinkre-moisesmcardona-steemapi-php-python-open-source-20171120t220655195z
categorytechnology
json_metadata{"tags":["technology"],"links":["https://github.com/moisesmcardona/steemapi-php-python/blob/master/steemapi-php/getFollowingCount/index.php","https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project"],"app":"steemit/0.1"}
created2017-11-20 22:06:54
last_update2017-11-20 22:06:54
depth1
children0
last_payout2017-11-27 22:06:54
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length934
author_reputation2,159,179,776,915
root_titleDeleted
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id21,023,891
net_rshares0
author_curate_reward""
vote details (1)