top 25 dangerous programming errors

sneakyimp

Just saw this today and thought it might be of some interest to the commmunity:

http://developers.slashdot.org/story/10/02/17/2327253/The-25-Most-Dangerous-Programming-Errors

Basically, a bunch of organizations prioritized script/program vulnerabilities in terms of prevalence and importance. In particular, this link was interesting:
http://cwe.mitre.org/top25/#Listing

It describes some common vulnerabilities and gives a few code examples.

vaaaska

I only had to click on three (four?) links to get to the real article...here it is...

http://cwe.mitre.org/top25/

djjjozsi

This page has good examples too.

sneakyimp

Interesting link, djjjozsi.

Any thoughts on how to screen for PHP code in an image comment?

Shrike

sneakyimp;10944781 wrote:
Interesting link, djjjozsi.

Any thoughts on how to screen for PHP code in an image comment?

The article mentions that an "upload" directory should not be inside the web root. This prevents all of the attacks mentioned since they rely on being able to execute the contents of the file directly. If this is not possible, and you felt so inclined, you could open the image using PHP/GD or PHP/Imagick and remove any <?php ?> tags from the comment.

frmjin

hi,,......plz remove all the errors....