"Hack" Demo: Blade if-else is not Security

Поделиться
HTML-код
  • Опубликовано: 18 ноя 2024
  • ХоббиХобби

Комментарии • 58

  • @morfer2001
    @morfer2001 2 года назад +10

    Good video. But in this case, the vulnerability is in the request-all() method without validation, not by using if-else inside blade. Even if you didnt use if-else and use a separete view for admin and normal user, you could "hack" changing the select values if there was no validation in the backend.

  • @shumit
    @shumit 4 года назад +2

    Thanks. Magnificent. These small, little security tips are so great for novices like us. And yes, of course we novices love these short and quick videos. We novices are always worried sick of security. Thank you again !!
    How about a video on hosting a Laravel app in production environment in a shared server with proper security configuration? Probably thousands of beginner level developers from around the world are thirsty for something like that. And, please keep up the great work you are doing !!

    • @PovilasKorop
      @PovilasKorop 4 года назад +1

      There are two problems with that:
      1. I never recommend a shared server for any kind of Laravel project. For many reasons.
      2. For non-shared servers, there are so so many different server environments and hostings that I can't shoot a video that would fit every hosting. But I've tried to list my recommendations in this article: laraveldaily.com/how-to-deploy-laravel-projects-to-live-server-the-ultimate-guide/

    • @shumit
      @shumit 4 года назад

      @@PovilasKorop Thank you so VERY MUCH for the link.

  • @Laflamablanca969
    @Laflamablanca969 4 года назад +12

    You should be checking for permissions on the backend anyway when the form gets submitted...

    • @Laflamablanca969
      @Laflamablanca969 4 года назад

      @Ali Maldonado Heredia oh lol... I see. I thought it was a given and any experienced dev would have know that

    • @DanielAbernathy
      @DanielAbernathy 4 года назад

      That's the whole point of the video

    • @marlonferreira5081
      @marlonferreira5081 4 года назад +1

      I usually build my validator in steps, so I can check the user permission and assign validator for that specific update.
      If (request()->user()->is_admin) {
      $rules[“is_admin”] = “required|boolean”;
      }
      request()->validate($rules);

  •  4 года назад +10

    I think this is important to let beginners know. But the video title is Click-Bait. And the same can be applied to the API without any Blade.

  • @msdeav
    @msdeav 4 года назад +1

    Thank you. Can you give a little example of storing that (01:23) kind of thing in the database?

    • @PovilasKorop
      @PovilasKorop 4 года назад +1

      Well, in this case, the database field is just a string type, but there are multiple ways how you can store it in DB: enum field, foreign key to another table etc. This video explains more: ruclips.net/video/3CkkzH4J7xw/видео.html

  • @RobbyAJM
    @RobbyAJM 3 года назад

    This means whatever you do validation at the front, you should also do validation on the back.

  • @jonatanla4485
    @jonatanla4485 4 года назад +1

    What would be the best approach to avoid HTML code injections on *disabled* elements? Besides not showing them or changing them to a simple label

    • @jonatanla4485
      @jonatanla4485 4 года назад

      @@Ahmed-157 How policies would work in that scenario?

  •  4 года назад +5

    Great tip but I'm still trying to find out what injecting HTML has to do with Blade.

    • @cannabclaus8036
      @cannabclaus8036 3 года назад

      Hiding certain options dosnt mean they cant be made. So blade if and elses arent the only safe point.

  • @bardhylfejzullahu7547
    @bardhylfejzullahu7547 4 года назад +4

    This has nothing to do with blade. It could be any php file/temolate

  • @poplach
    @poplach 4 года назад

    Simple rule - all user input data should be ALWAYS validated on the server side.

  • @DreamskyDance
    @DreamskyDance 4 года назад +1

    Nice explanation, although i am not much experienced in laravel framework ( started learning it two weeks ago so i finnaly learn some php frameworks, been working with bona fide no framework php for years now.. :P ), i thought that is something normal and generaly acceptable practice, i mean anybody could write anything into html via browser inspector.
    Where i work and on ancient legacy library that kind of practice is normal, once you chack for display for user and another time you check before saving into db data that user inputed.
    Although we do not work in laravel I will show this to junior collegues when explaining why do they need to put validation while saving as well :D

    • @Bevallalom
      @Bevallalom 4 года назад +2

      You are right. Data validation is a must. He makes this video for beginners. It's possibly not new to you.

    • @PovilasKorop
      @PovilasKorop 4 года назад +1

      @@Bevallalom You would be surprised how many non-beginners are too "lazy" to validate stuff on the back-end. So for them, this video is just a reminder.

    • @Bevallalom
      @Bevallalom 4 года назад +1

      @@PovilasKorop true. :) btw, I like your videos. I started using laravel in January so I'm a beginner to laravel. But not in PHP. Keep up the good work!

  • @ДоминикБеляшов
    @ДоминикБеляшов 4 года назад +1

    By default you shouldn't trust to incoming request data.

  • @eokwukwe
    @eokwukwe 4 года назад

    Thank you for these timely tips.
    Please, could you do a quick demo on how to do social authentication for RESTful API with Laravel and VUE SPA using Laravel Socialite? One of my main concerns is the callback URL. Would it be a URL pointing to the frontend or backend?

    • @PovilasKorop
      @PovilasKorop 4 года назад

      There are multiple ways to implement it. But currently I'm not planning a video on that topic, have a big list already for other topics.

    • @eokwukwe
      @eokwukwe 4 года назад

      @@PovilasKorop Okay. Thanks again for your wonderful tips.

  • @rudikurniawan99
    @rudikurniawan99 4 года назад

    I still don't understand with this, it's only admin who can get acces to that form anyway,

  • @muhaecaldwikhatami7838
    @muhaecaldwikhatami7838 4 года назад

    what admin theme do you use?

    • @PovilasKorop
      @PovilasKorop 4 года назад +1

      I use our own generator www.quickadminpanel.com - design theme is CoreUI - coreui.io

  • @GergelyCsermely
    @GergelyCsermely 3 года назад

    Very interesting! Thanks

  • @artificallead499
    @artificallead499 2 года назад +1

    that was very good and im assuming this can be done regardless of the language good to know i love ethical hacking

  • @alimahdavi9775
    @alimahdavi9775 4 года назад

    short videos is perfect👌👌
    Please make short learn about how to make editable textarea based on markdown like ckeditor but small and customizable with livewire and alpinejs 🌹

  • @namoudnormand3048
    @namoudnormand3048 4 года назад

    this is not a Blade if-else problem. the problem is not double checking in the backend

  • @bumblebity2902
    @bumblebity2902 4 года назад +7

    HTML code injections, even juniors know how avoid that :).

    • @hamzabouk5982
      @hamzabouk5982 4 года назад +3

      dont think so . i have seen this issue in some serious companies apps . and it always work like charm

  • @kristhianortizarteaga4955
    @kristhianortizarteaga4955 4 года назад +1

    Sería muy bueno si implementa una base de datos de validaciones de datos cuando un usuario cumple ciertas características en el perfil esto en el lado servidor

  • @sangeeth810
    @sangeeth810 4 года назад

    Midlleware checking separatley for each function in controller.ithink this will not happen

  • @christoherright6430
    @christoherright6430 4 года назад +1

    Firstly, I would encrypt the value in options with the APP_KEY .That should prevent HTML injection in all cases.

  • @RituSingh-wi3bv
    @RituSingh-wi3bv 3 года назад

    thanku sir

  • @apiwiyusuf7400
    @apiwiyusuf7400 4 года назад

    Thank you so much

  • @JamesAutoDude
    @JamesAutoDude Год назад

    Wow I always thought PHP was server side enough that you couldn't do this :/

  • @imranlashari6578
    @imranlashari6578 4 года назад

    Wow good, I like it...

  • @mostafamahmoud175
    @mostafamahmoud175 4 года назад

    It's very good
    But why the free plan are removed form quick admin panel 😃

    • @PovilasKorop
      @PovilasKorop 4 года назад +1

      Well, maybe because I personally invested $100k+ in building that software, and I have a family/team to feed? :)

    • @mostafamahmoud175
      @mostafamahmoud175 4 года назад

      @@PovilasKorop my question doesn't mean anything , I just inquiry because it was a great tool for me to learn , specially I am fresh graduated .
      But it's great for you ❤️
      Best regards ❤️❤️💪

  • @aminulislampalash40
    @aminulislampalash40 4 года назад

    Thanks ❤️

  • @tjdstudio893
    @tjdstudio893 4 года назад

    Beside not validating values using request all is extreme bad idea of writing functions.

  • @Zugmaschine
    @Zugmaschine 3 года назад

    Never trust a user input. And it comes from a user ...

  • @Ahmed_Elmahdy
    @Ahmed_Elmahdy 4 года назад +1

    The title is misleading

    •  4 года назад

      Yep! Now rookies will start saying on twitter that Blade is not safe. The title should be: "Always validate user inputs, even if that comes from intranet apps users".

  • @eravazzano
    @eravazzano 4 года назад

    If you don't know about this "hack" then you're a bad dev.
    Also the truth is, the only "hack" in this scenario is the lazy dev hacking his way through his code to ship faster. It's lazy.

  • @MiteshBhanushali08
    @MiteshBhanushali08 4 года назад

    I really apricate your efforts and always find something new....Sir can you please make video on how can we integrate spatie's laravel-permission package. github.com/spatie/laravel-permission

    • @PovilasKorop
      @PovilasKorop 4 года назад +1

      I have a demo project for it: github.com/LaravelDaily/laravel-roles-permissions-manager
      Also older article: laravel-news.com/two-best-roles-permissions-packages

    • @MiteshBhanushali08
      @MiteshBhanushali08 4 года назад

      ​@@PovilasKorop Thank you for the help.
      Sir i saw there is one course for the same is offered by you...In that you have used this package only?
      Sir just want to know is there any discounts will be coming for Students for your courses?

    • @PovilasKorop
      @PovilasKorop 4 года назад +1

      @@MiteshBhanushali08 from what I remember, I've used no packages there to explain how roles/permissions work at all, and mentioned Spatie as an option only in one lesson. Regarding discounts, my courses are already the cheapest on the market, no discounts are planned at the moment: twitter.com/PovilasKorop/status/1293921004205543426

  • @alexandrsolonytskyi5468
    @alexandrsolonytskyi5468 4 года назад

    This is a bad code from the beginning and there is no vulnerability in this, please do not invent. It's just not the correct code. Everything must be validated by FormRequests!!!!! The author is wrong! Dislike for false information

  • @dgloria
    @dgloria 4 года назад

    I thought these videos are for advanced developers. Hmmm. If your code doesn't contain minimum security I shouldn't follow your courses. I still have no idea what quickadminpanel is for, however I've watched about 30 videos of it so far but if it produces code with such errors I'll stay away from it.