Insecure Use of Language/Framework API

Fixing Insecure Use of Function handling Functions

About insecure use of language/framework APIs

What is insecure use of language/framework APIs?

Insecure use of language or framework API refers to a security vulnerability that arises when an application uses an API in an unsafe or insecure manner. This can result in unintended behavior or access, which can be exploited by attackers to gain unauthorized access, steal data, or perform other malicious actions.

This type of vulnerability can arise due to a lack of understanding on the part of the developer, or it can result from the use of outdated or deprecated APIs that are no longer considered secure.

What is the impact of insecure use of language/framework APIs?

Insecure use of language/framework APIs can have a wide-ranging impact, depending on the type of vulnerability and the attacker's goals.

Here are some potential impacts of insecure use of language or framework API:

• Unauthorized access: An attacker may be able to gain unauthorized access to a system or application, giving them access to sensitive data or functionality.
• Data theft: An attacker may be able to steal data from the system, including personally identifiable information, financial data, or other sensitive data.
• Denial of service: An attacker may be able to launch a denial-of-service attack by exploiting vulnerabilities in the API.
• System compromise: In some cases, a successful attack on an insecure API can lead to a complete compromise of the system, allowing the attacker to take full control.

How to prevent the insecure use of language/Framework APIs?

Here are some measures that can help prevent insecure use of language or framework API:

• Use secure APIs: Use up-to-date and secure APIs that are well-maintained and well-documented. This can help prevent the use of deprecated APIs that are no longer considered secure.
• Regular security audits: Regularly audit your system and application for security vulnerabilities, including insecure use of language or framework API vulnerabilities. Use automated tools and manual testing to identify potential issues and fix them before they can be exploited.
• Education and training: Educate your development team about the risks of insecure use of language or framework API and the measures that can be taken to prevent them. Ensure that everyone on the team is aware of secure coding practices and understands the importance of security in application development.

The following methods are dangerous if used incorrectly:

• create_function
• call_user_func
• call_user_func_array
• forward_static_call
• forward_static_call_array
• function_exists
• register_shutdown_function
• register_tick_function

Option A: Avoid User Input in Function handling Functions

1. Go through the issues that GuardRails identified in the PR/MR

2. An example of an insecure usage of create_function() is shown below

   // Note: create_function is also deprecated as of PHP 7.2.0
   create_function($_GET['func']);

3. Remove the user input from this

4. Create a normal function that handles user input as arguments

5. Ship it 🚢 and relax 🌴