1

Modern template engines for php (say, dwoo or smarty) can use objects as variables. You can use {$obj->method()}, which is really convenient, and i am using this a lot. But, there is a clear security problem with exporting directly objects from ORM, which have methods such as insert, delete etc. Is there any sane method to expose only part of methods to template engine? I was thinking of wrapper exposing only whitelisted methods: 

$aTplVars = array (new TplWrapper(new User($nUserId),  array('getAccount','getStatus')));

What do you thinking (there is clear performance overhead)? Or maybe there is something like that in some existing template engines for php?

ts.
  • 10,510
  • 7
  • 47
  • 73
  • @ts this doesn't make any sense. If an attacker has remote code execution then you have already lost. Its check mate, there is nothing you can do. The whole point of security is to stop this from happening in the first place. In secuirty you need to define who the threat is. For these reasons I recommend removing the [security] tag from this post. – rook Sep 19 '10 at 00:12

1 Answers1

0

You can't "cripple" an object in PHP (or any language I know) after it's been created. Using objects might seem nice, but you should fetch the relevant data for your template in the controller and put it into an array which you can safely assign to the template.

halfdan
  • 33,545
  • 8
  • 78
  • 87
  • the problem is that there are nested objects (user->account->history->.. etc) and there is a need of perform some costly operations depending on current view – ts. Sep 18 '10 at 09:05
  • and, just to add, you can "cripple" an object in php - you can use runkit , you can do it also in python and there is bunch of languages which allows to manipulate methods and functions like variables. – ts. Sep 18 '10 at 09:09
  • Never seen runkit before, thanks for noticing (although removing methods during runtime is kinda sick). – halfdan Sep 18 '10 at 09:16
  • i never considered runkit as an option here ;) – ts. Sep 18 '10 at 09:22