Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Description
Calling assert with user input is equivalent to eval'ing, which can lead to code injection vulnerabilities. This occurs when user-controlled data is passed to the assert function, allowing an attacker to inject malicious code.
Examples
Insecure Code
php
$user_input = $_GET['input']; assert($user_input);Secure Code
php
$user_input = $_GET['input']; if (validate_input($user_input)) { assert($user_input); }Remediation
Validate and sanitize all user input before passing it to the assert function. Consider using a whitelist approach to only allow expected input.
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0745 |
| Category | Injection |
| Severity | CRITICAL |
| CWE | CWE-95 |
| Confidence | HIGH |
| Impact | HIGH |
| Likelihood | HIGH |
| Exploitability | EASY |
| Tags | code injection, eval injection |
| OWASP | A1:2017-Injection, A03:2021-Injection |
References
- https://www.php.net/manual/en/function.assert
- https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php