Web Application Security
Chris Shifflet gave a talk on PHP security at OSCON 2005 last week and made his slides available online through his blog. Chris Shifflet is the founder of Brain Bulb, a PHP consultancy firm, and is the author of a number of books on PHP security. While his slides are no replacement for his books and other detailed references online, they do a great job at illustrating the biggest reason why I shy away from PHP in general, and from hosting untrusted PHP applications in particular: PHP relies heavily on a programmer's vigilance for security.
As a security-conscious systems administrator who cannot afford to spend time personally auditing each and every line of PHP code on my servers, programmer vigilance is an often unacceptable assumption. It's terrifying just looking at the steady stream of advisories about remotely-exploitable vulnerabilities of applications written in PHP, on mailing lists like BugTraq, or specialized forums like phpSecure();.
Worse, many of these programs are community-driven projects used and developed by more than one person, with source code that can be freely reviewed and audited. Imagine the increased risk of using PHP as a platform for web-based applications that sit between relatively sensitive corporate data and the Internet, developed and maintained by anywhere from one to a handful of in-house PHP developers who are subjected to rapidly changing requirements and insane deadlines.
There is nothing wrong with PHP per se, but the risks are obvious. As a web development platform, it allows developers a tad too much freedom. Unless ample investments are made to allow for the proper security-oriented training of a PHP development team, and regular, timely security audits of PHP applications, PHP applications offer a relatively easy entry point into sensitive corporate data and critical systems.
ZOPE AS AN ALTERNATIVE
As a consultant with experience in both systems administration and web application development, I highly recommend Zope as an alternative development and hosting platform. Among the many benefits that Zope brings, one that stands out significantly over PHP is the tightly-integrated security system built into Zope from the ground up. The Zope Developer's Guide makes a clear point about this with its summary of the default Zope security policy. To wit:
- access to an object which does not have any associated security information is always denied.
- if an object is associated with a permission, access is granted or denied based on the user's roles. If a user has a role which has been granted the permission in question, access is granted. If the user does not possess a role that has been granted the permission in question, access is denied.
- if the object has a security assertion declaring it public, then access will be granted.
- if the object has a security assertion declaring it private, then access will be denied.
- accesses to objects that have names beginning with the underscore character _ are always denied.
Zope's object database layer and the lack of direct involvement between web applications and actual files on the server provides a vital layer of security that makes access to arbitrary files on the server's filesystem a difficult feat. Access to arbitrary objects within theobject database is likewise restricted by Zope's deny-by-default security policy. Couple these with built-in virtual hosting capabilities, the ability of folders to have their own user databases and security policies, and the powerful but restricted web-based management interface, and Zope allows for relatively secure multi-system web application hosting, especially in environments where users may not trust each other or may not be counted on to be extremely vigilant about security.
Zope also handles input filtering and output escaping by default, especially when accessing databases through Z SQL Methods. Z SQL Methods further enable the restriction of access to database login and password information, as well as database schema. By providing the capability to restrict access to the configuration of database and SQL objects, work can be delegated to multiple
"security levels" of web application developers. For example, "HTML form managers" may be designated to work with the data through database and SQL objects, which are in turn handled by more senior developers with direct information about the databases and training about query optimization.
The possibilities with Zope are endless. Despite the fact that PHP developers and F/OSS applications written in PHP are easier to find, Zope provides a viable alternative for organizations needing to develop and maintain secure web application systems that provide selective access to sensitive corporate data.
