<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1078332090;
mso-list-type:hybrid;
mso-list-template-ids:-1228363012 -1578493848 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Calibri","sans-serif";
mso-fareast-font-family:Calibri;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>“.” is a pattern that says the string contains at least one character, it’s a wild card so that’s why anything matches. Granted, regex’s aren’t easy to use but you can accomplish a lot with very simple patterns, plus I’ve not seen or been presented with a better idea.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Validation is (and will be) pushed for a couple of reasons:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>-<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>To keep users from making poor decisions by forcing them to explicitly make (and think about) them<o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>-<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>To try and limit unintended uses (we could go much further here)<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Not everyone is risk aware and I feel a responsibility to try and help users limit risk. I suppose the lack of documentation doesn’t support that last statement but we can fix that. Without validation efforts there’s potentially an inherent assumption that the rest of the codebase is insecure. We’ve made mistakes and take the topic seriously.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>That said, I’m not adverse to a “no validation” switch as long as it’s off by default, file a ticket…<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Steve<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> Jan Hartmann [mailto:j.l.h.hartmann@uva.nl] <br><b>Sent:</b> Friday, April 29, 2011 5:38 AM<br><b>To:</b> woodbri@swoodbridge.com<br><b>Cc:</b> Lime, Steve D (DNR); mapserver-users@lists.osgeo.org; Rahkonen Jukka<br><b>Subject:</b> Re: [mapserver-users] RE: Validation beyond [A-z]<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><pre>Thanks Steve. I don't understand the syntax: in the regex versions I use, "." means "one and just one character", not any string. <o:p></o:p></pre><pre>Any string excluding the null-string would be ".+" or "..*" <o:p></o:p></pre><pre><o:p> </o:p></pre><pre>More generally, I still have problems with validation as a concept: it's too difficult, and perhaps that's why it isn't documented. <o:p></o:p></pre><pre>I have postings about this subject in my personal mapserver-dev mail-archive dating from 2002 <o:p></o:p></pre><pre>(couldn't find them on the official site any more), and there still isn't a clear solution almost ten years later.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>IMHO the major security risk of MapServer CGI is that it gives access to the filesystem outside the web-root. Wouldn't it be better to keep security at that level,<o:p></o:p></pre><pre>i.e. only let MapServer access explicitly defined parts of the filesystem? Within these parts, it's up to the web-site builder to put only those things that should be<o:p></o:p></pre><pre>visible and nothing else. You don't put an ultra-secret document on the web and afterward restrict access to portions only, you just put there what you want to show <o:p></o:p></pre><pre>to the world. Same goes for validations on extent or styles: just make your selections of what you want to show "before" you let MapServer loose on it.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>The same story can be told for database access and restrictions on SQL queries: IMHO that is a matter for the database system. <o:p></o:p></pre><pre>It's easy enough to put everything behind barriers with user privileges and views. Why should mapserver double all that security? <o:p></o:p></pre><pre>Any competent database administrator should know how to prevent SQL injects, <o:p></o:p></pre><pre>and MapServer should not be there to protect those who are unable to.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I've been working with Cloud VM's for about a year now, and in that environment many security problems disappear: just make small, dedicated<o:p></o:p></pre><pre>servers and interconnect them, e.g. with cascading services.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>So my view would be: let the Operating System and the Database do everything needed to secure files and databases, and put in your web services only afterwards.<o:p></o:p></pre><pre>It all gets too complex with all those interconnected securities at all levels of the system (my main problem with Apache).<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>In the last ressort: KISS (Keep It Simple Steve (whoever)) :-)<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Jan <o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>-------------------------------------------------------------------------------------<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>On 04/28/11 18:48, Steve Woodbridge wrote<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Hi Jan,<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I do not think there is a global OFF switch for validation, but where <o:p></o:p></pre><pre>validation is required you can include the regex validation string of <o:p></o:p></pre><pre>/./ which means match anything except a null string, or to also accept a <o:p></o:p></pre><pre>null string then use /.*/<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>You still need to be aware of when you should put a validation in place <o:p></o:p></pre><pre>even if it accepts any string.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Regards,<o:p></o:p></pre><pre> -Steve W<o:p></o:p></pre><p class=MsoNormal><br><br>On 04/28/11 18:48, Jan Hartmann wrote: <o:p></o:p></p><p class=MsoNormal>I find the whole validation issue difficult and not well documented (<a href="http://trac.osgeo.org/mapserver/ticket/3754">http://trac.osgeo.org/mapserver/ticket/3754</a>, last updated four hours ago). How do I put all validation off? I really don need that much security.<br><br>Jan<br><br>On 04/28/11 18:19, Lime, Steve D (DNR) wrote: <o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I see the problem, just not sure how to fix it. Steve W. provided some possibilities but that’s probably not the only approach. It would be helpful if some interested person(s) got together and drafted an RFC. I think the devs would be in a position to help define implementation details if the problem is well defined along with a proposed solution.</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Steve</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><div><div style='border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;border-color:-moz-use-text-color -moz-use-text-color'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:mapserver-users-bounces@lists.osgeo.org">mapserver-users-bounces@lists.osgeo.org</a> [<a href="mailto:mapserver-users-bounces@lists.osgeo.org">mailto:mapserver-users-bounces@lists.osgeo.org</a>] <b>On Behalf Of </b>Rahkonen Jukka<br><b>Sent:</b> Thursday, April 28, 2011 4:21 AM<br><b>To:</b> <a href="mailto:mapserver-users@lists.osgeo.org">mapserver-users@lists.osgeo.org</a><br><b>Subject:</b> [mapserver-users] Validation beyond [A-z]</span><o:p></o:p></p></div></div><p class=MsoNormal> <o:p></o:p></p><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>Hi,</span><o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>Validation is nowadays needed in quite a many places in a mapfile. However, we who live outside the English speaking world tend to have more characters in the alphabet than A to Z. This makes the mapfile validation idea only half effective because for making things to work at all with the native data we must accept almost everything that is non-numeric with wildcards. Are there others who think that this is a problem?</span><o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>Stephen Woodbidge commented slightly this topic in another thead a month ago (Mar 29, 2011)</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'><a href="http://lists.osgeo.org/pipermail/mapserver-users/2011-March/068307.html">http://lists.osgeo.org/pipermail/mapserver-users/2011-March/068307.html</a></span><o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>-Jukka Rahkonen-</span><o:p></o:p></p></div><pre><o:p> </o:p></pre><pre>_______________________________________________<o:p></o:p></pre><pre>mapserver-users mailing list<o:p></o:p></pre><pre><a href="mailto:mapserver-users@lists.osgeo.org">mapserver-users@lists.osgeo.org</a><o:p></o:p></pre><pre><a href="http://lists.osgeo.org/mailman/listinfo/mapserver-users">http://lists.osgeo.org/mailman/listinfo/mapserver-users</a><o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>_______________________________________________<o:p></o:p></pre><pre>mapserver-users mailing list<o:p></o:p></pre><pre><a href="mailto:mapserver-users@lists.osgeo.org">mapserver-users@lists.osgeo.org</a><o:p></o:p></pre><pre><a href="http://lists.osgeo.org/mailman/listinfo/mapserver-users">http://lists.osgeo.org/mailman/listinfo/mapserver-users</a><o:p></o:p></pre></div></body></html>