0

TLDR; I want to enable database-logging of xss_clean() when replacing evil data.

I want to enable database logging of the xss_clean() function in Security.php, basically what I want to do is to know if the input I'm feeding xss_clean() with successfully was identified to have malicious data in it that was filtered out or not.

So basically:

$str = '<script>alert();</script>';
$str = xss_clean($str);

What would happen ideally for me is:

  1. Clean the string from XSS
  2. Return the clean $str
  3. Input information about the evil data (and eventually the logged in user) to the database

As far as I can see in the Security.php-file there is nothing that takes care of this for me, or something that COULD do so by hooks etc. I might be mistaken of course.

Since no logging of how many replaces that were made in Security.php - am I forced to extend Security.php, copy pasting the current code in the original function and altering it to support this? Or is there a solution that is more clean and safe for future updates of CodeIgniter (and especially the files being tampered/extended with)?

Tobias
  • 491
  • 3
  • 10

1 Answers1

1

You would need to extend the Security class, but there is absolutely no need to copy and paste any code if all you need is a log of the input/output. Something along the lines of the following would allow you to do so:

Class My_Security extends CI_Security {

    public function xss_clean($str, $is_image = FALSE) {
        // Do whatever you need here with the input ... ($str, $is_image)

        $str = parent::xss_clean($str, $is_image);

        // Do whatever you need here with the output ... ($str)

        return $str;
    }

}

That way, you are just wrapping the existing function and messing with the input/output. You could be more forward compatible by using the PHP function get_args to transparently pass around the arguments object, if you were concerned about changes to the underlying method.

beseku
  • 917
  • 1
  • 6
  • 12
  • Ok, that solved half of my problem. Right now I'm trying to figure out how to actually load a model of mine. Is that the right thing to do here? I've tried to do `$this->load = load_class('Loader', 'core');` and then doing `$this->load->model('users_model');` but I get a whitescreen at `$this->load->model();` – Tobias Jul 06 '11 at 20:09