{"id":41,"date":"2021-01-27T21:33:00","date_gmt":"2021-01-27T21:33:00","guid":{"rendered":"https:\/\/murat.one\/?p=41"},"modified":"2021-02-08T21:52:12","modified_gmt":"2021-02-08T21:52:12","slug":"a-note-on-yii2-code-generation-safe-usage","status":"publish","type":"post","link":"https:\/\/murat.one\/?p=41","title":{"rendered":"A note on Yii2 code generation safe usage"},"content":{"rendered":"\n<p class=\"has-text-align-left justifier\">Yii2 is one of the popular PHP frameworks with difficult name to read. Correct use of frameworks significantly reduces development time, and also covers most of the security issues. But this, of course, does not mean the absolute safety of Yii2 applications, since there is always a human factor in any system. This short note shows a real case where code generation in Yii2 or any other framework can make problems with safety.<\/p>\n\n\n\n<p>So, let&#8217;s say we have the \u201cusers\u201d table:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"386\" src=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/table_users-1024x386.jpg\" alt=\"\" class=\"wp-image-45\" srcset=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/table_users-1024x386.jpg 1024w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/table_users-300x113.jpg 300w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/table_users-768x289.jpg 768w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/table_users.jpg 1049w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"justifier\">After generating a CRUD in Gii for the users table, we have a new UsersSearch.php file that is responsible for finding data in our table. From the entire file, we are interested in this piece of code:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"914\" height=\"191\" src=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/generated_code.jpg\" alt=\"\" class=\"wp-image-46\" srcset=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/generated_code.jpg 914w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/generated_code-300x63.jpg 300w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/generated_code-768x160.jpg 768w\" sizes=\"(max-width: 914px) 100vw, 914px\" \/><\/figure>\n\n\n\n<p class=\"justifier\">The soulless auto generation script, of course, doesn&#8217;t care whether users need to be searched by password, so it honestly generates a request for the \u201cpassword\u201d field. Often, developers remove the output of the password field from frontend part, but forget to remove it from the generated search class. As a result, you can do the following thing:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"923\" height=\"710\" src=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/users_search.jpg\" alt=\"\" class=\"wp-image-47\" srcset=\"https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/users_search.jpg 923w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/users_search-300x231.jpg 300w, https:\/\/murat.one\/wp-content\/uploads\/2021\/02\/users_search-768x591.jpg 768w\" sizes=\"(max-width: 923px) 100vw, 923px\" \/><\/figure>\n\n\n\n<p class=\"justifier\">By adding the UsersSearch [password] parameter to the search query, we can guess the user&#8217;s password character by character. Although passwords are hashed with an irreversible function, you can always perform successful brute force the hash of a simple password. Even if it is not a password, it can be some kind of confidential information such as phone number, home address, etc.<\/p>\n\n\n\n<p class=\"justifier\">For experienced developers we haven\u2019t discovered something new, but we recommend to check your projects for the existence of such mistake. The information can be relevant for any frameworks that use similar code generation.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Yii2 is one of the popular PHP frameworks with difficult name to read. Correct use of frameworks significantly reduces development time, and also covers most of the security issues. But this, of course, does not mean the absolute safety of Yii2 applications, since there is always a human factor in any system. This short note&hellip; <a class=\"more-link\" href=\"https:\/\/murat.one\/?p=41\">Continue reading <span class=\"screen-reader-text\">A note on Yii2 code generation safe usage<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[10],"tags":[11,9],"_links":{"self":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/41"}],"collection":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=41"}],"version-history":[{"count":4,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/41\/revisions"}],"predecessor-version":[{"id":63,"href":"https:\/\/murat.one\/index.php?rest_route=\/wp\/v2\/posts\/41\/revisions\/63"}],"wp:attachment":[{"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/murat.one\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}