{"id":254,"date":"2011-01-06T10:07:56","date_gmt":"2011-01-06T08:07:56","guid":{"rendered":"http:\/\/antynet.pl\/?p=254"},"modified":"2011-01-06T11:44:45","modified_gmt":"2011-01-06T09:44:45","slug":"blad-w-php-podatnosc-na-dos","status":"publish","type":"post","link":"https:\/\/www.antynet.pl\/index.php\/2011\/01\/06\/blad-w-php-podatnosc-na-dos\/","title":{"rendered":"B\u0142\u0105d w PHP, podatno\u015b\u0107 na DoS. Zabezpieczenie przed atakiem"},"content":{"rendered":"

Mamy powa\u017cny b\u0142\u0105d w PHP.
\nWystarczy metod\u0105 GET wywo\u0142a\u0107 skrypt:<\/p>\n

np. forum PHPBB.
\n viewforum.php?f=22250738585072011e-324<\/strong><\/p>\n

aby skutecznie zablokowa\u0107 serwer www.<\/p>\n

inne formy zapisu liczby:
\n0.22250738585072011e-307
\n22.250738585072011e-309
\n2.2250738585072011e-308<\/p>\n

Powodem problemu jest funkcja zend_strtod.<\/p>\n

Jak si\u0119 zabezpieczy\u0107?<\/strong><\/p>\n

Mo\u017cna na pocz\u0105tku ka\u017cdego skryptu doda\u0107:
\nif (strpos(str_replace(’.’, ”, serialize($GLOBALS)), '22250738585072011′)!==false) die();<\/p><\/blockquote>\n

Lub co jest znacznie prostsze wykorzysta\u0107 mod_security:
\nSecRule QUERY_STRING „\\d+e\\-\\d+” „phase:2,deny,status:404”<\/p><\/blockquote>\n

Mo\u017cna tak\u017ce zastosowa\u0107 mechanizmy apache:<\/p>\n

<LocationMatch „.*\\d+e\\-\\d+.*>
\ndeny from all
\n<\/LocationMatch><\/p><\/blockquote>\n

Od tej chwili nie jeste\u015bmy ju\u017c podatni na ten atak DoS.<\/p>\n","protected":false},"excerpt":{"rendered":"

Mamy powa\u017cny b\u0142\u0105d w PHP. Wystarczy metod\u0105 GET wywo\u0142a\u0107 skrypt: np. forum PHPBB. viewforum.php?f=22250738585072011e-324 aby skutecznie zablokowa\u0107 serwer www. inne formy zapisu liczby: 0.22250738585072011e-307 22.250738585072011e-309 2.2250738585072011e-308 Powodem problemu jest funkcja zend_strtod. Jak si\u0119 zabezpieczy\u0107? Mo\u017cna na pocz\u0105tku ka\u017cdego skryptu doda\u0107: if (strpos(str_replace(’.’, ”, serialize($GLOBALS)), '22250738585072011′)!==false) die(); Lub co jest znacznie prostsze wykorzysta\u0107 mod_security: SecRule QUERY_STRING […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-254","post","type-post","status-publish","format-standard","hentry","category-bez-kategorii"],"_links":{"self":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/254","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/comments?post=254"}],"version-history":[{"count":7,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/254\/revisions"}],"predecessor-version":[{"id":259,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/254\/revisions\/259"}],"wp:attachment":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/media?parent=254"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/categories?post=254"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/tags?post=254"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}