yii mass model attribute assignment and xss security concerns - security

Question

$model->attributes = $_GET[ 'Submission' ];
This looks really scary to me, but it's how yii assigns attributes to a model. Is this a security risk for XSS? Should it not be sanitized somehow first? I know models get validated, but is it enough from malicious input, especially if saving to the database and if you forget to sanitize output...

Answer 1

Massive assignment is not default 'on' . It will only be made for fields which have passed some explicit validation rule.
$model->attributes = $_GET[ 'Submission' ];
is equivalent to this code,
$model->attribute1 = $_GET['Submission']['attribute1'];
$model->attribute2 = $_GET['Submission']['attribute2'];
$model->attribute3 = $_GET['Submission']['attribute3'];
Any XSS, SQL Injection vulnerabilities present in the former will be present in later too;
To prevent against XSS, SQL Injection you can use the bundled CHtmlPurifier class which is a wrapper for HTML Purifier filter library. There are multiple ways to use CHtmlPurifier, one way to use is as a filter in the model rules, which will check for XSS strings.
If your model rules function was like this for example
public function rules(){
return array(
array('username, password, salt, email', 'required'),
array('username, password, salt, email', 'length', 'max'=>128),
array('first_name,last_name,username,email','safe','on'=>'search'),
);
}
if you use massive assignment with this rules set with $model->attributes = $_GET[ 'Submission' ];
username and email will be assigned however first_name, last_name will not be assigned to the model as they are only safe on search scenario.
You can add a rule to make them search on say create,update like this
public function rules(){
return array(
array('username, password, salt, email', 'required'),
array('username, password, salt, email', 'length', 'max'=>128),
array('first_name,last_name','safe','on'=>'create,update'),
array('first_name,last_name,username,email','safe','on'=>'search'),
);
}
This will make the safe for massive assignment, however leaving you still vulnerable to XX. To protect against XSS you can use this type of filter as a rule
public function rules(){
return array(
array('username, password, salt, email', 'required'),
array('username, password, salt, email', 'length', 'max'=>128),
array('first_name,last_name,username,email','filter'=>array($obj=new CHtmlPurifier(),'purify')),
array('first_name,last_name,username,email','safe','on'=>'search'),
);
}
Now first_name,last_name,username,email are all purified for XSS,SQL strings before being validated and massive assignment also works for all four attributes.
Tl;DR
Yii provides with you default safety feature, massive assignment only works when there is explicit model validation rule
XSS will happen independent of whether or not massive assignment is used

Answer 2

This is probably a decent article on secure Yii apps http://www.yiiframework.com/wiki/275/how-to-write-secure-yii-applications/
Additionally, you can filter any input through the models with their filters and rules or beforeSave() methods