Subject: [Tools-implementation] Fwd: Re: Initial private repository populated

From: Robert Sparks <[email-masked]>
Date: Mon, 8 Jun 2020 15:45:13 -0500

All -

This is mostly an FYI, but also an opportunity for you to throw a flag 
if you see an issue.

I will work with the RPC on this PDO vs MySQLi issue, and with Jay on 
the notion of extending hours.

RjS

-------- Forwarded Message --------
Subject: 	Re: Initial private repository populated
Date: 	Mon, 8 Jun 2020 21:25:53 +1200
From: 	Stephen Shkardoon <[email-masked]>
To: 	Robert Sparks <[email-masked]>
CC: 	Hugh Davenport <[email-masked]>, Simon Howard 
<[email-masked]>, Henrik Levkowetz <[email-masked]>, 
Priyanka Narkar <[email-masked]>, Alice Russo <[email-masked]>

Hi Robert.

For implementing prepared statements, the first decision that needs to 
be made is whether the code should use the PDO or MySQLi extension. Most 
developers and frameworks strongly prefer the PDO framework, so it is my 
recommendation, but you can implement prepared statements using either. 
In both cases, the object oriented interface is the way to go.

Assuming you are using PDO, 
https://www.php.net/manual/en/pdo.prepared-statements.php shows how to 
use the new API.

In terms of code, I would suggest modifying db.php to return a PDO 
object rather than a mysqli handle, then go through every place that 
calls open_db and modify it to use the PDO object and prepared 
statements. There aren't a lot of shortcuts for this, but I'm happy to 
help out. I expect you can modify each database call to use PDO within 5 
minutes or less for each.

If you would like, I can send a Pull Request with changes so they can be 
reviewed. You'll need to decide between PDO or MySQLi, but once that is 
done, I can start sending them.

Also, if I do spend a lot of time helping with the individual coding 
portions of this, I won't have time to help with fixing the individual 
XSS issues unless we expand the number of hours towards resolution on 
the project. I'm not sure what the process is for that, but if it's 
something you'd like to do, let us know.

Thanks

On Sat, Jun 6, 2020 at 7:31 AM Robert Sparks <[email-masked] 
<mailto:[email-masked]>> wrote:

    Stephen -

    The repository at https://github.com/ietf-tools/rpc-staging is now
    populated.

    It has three files you haven't seen before:

    Two are css files at
    https://github.com/ietf-tools/rpc-staging/tree/master/rfc-ed/web/staff/style

    and one is a php file at
    https://github.com/ietf-tools/rpc-staging/tree/master/rfc/htdocs/parser

    We all have draft 0.5 of your report.

    I think we should start with getting your help in the remediation of
    F02
    (R05).

    RjS

-- 
*Stephen Shkardoon*
Security Consultant - ZX Security Limited