markstory · November 4, 2013 22:23
diff --git a/curl session b/curl session
 $ curl -k "https://cake.localhost.com/tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/"
 <!DOCTYPE html>
 <html>
 <head>
 	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />	<title>
 		CakePHP: the rapid development php framework:
 		Errors	</title>
 	<link href="/favicon.ico" type="image/x-icon" rel="icon" /><link href="/favicon.ico" type="image/x-icon" rel="shortcut icon" /><link rel="stylesheet" type="text/css" href="/css/cake.generic.css" /></head>
 <body>
 	<div id="container">
 		<div id="header">
 			<h1><a href="http://cakephp.org">CakePHP: the rapid development php framework</a></h1>
 		</div>
 		<div id="content">


 			<h2>Missing Method in TasksController</h2> <p class="error">
 	<strong>Error: </strong>
 	The action <em>aaa&#039;;&lt;img src=&#039;a&#039; onerror=&#039;alert(&quot;XSS&quot;)&#039;</em> is not defined in controller <em>TasksController</em></p>
 <p class="error">
 	<strong>Error: </strong>
 	Create <em>TasksController::</em><em>aaa&#039;;&lt;img src=&#039;a&#039; onerror=&#039;alert(&quot;XSS&quot;)&#039;()</em> in file: app/Controller/TasksController.php.</p>
 <pre>
 &lt;?php
 class TasksController extends AppController {

 <strong>
 	public function aaa&#039;;&lt;img src=&#039;a&#039; onerror=&#039;alert(&quot;XSS&quot;)&#039;() {

 	}
 </strong>
 }
 </pre>
 <p class="notice">
 	<strong>Notice: </strong>
 	If you want to customize this error message, create app/View/Errors/missing_action.ctp</p>
 <h3>Stack Trace</h3>
 <ul class="cake-stack-trace">
 	<li><a href="#" onclick="traceToggle(event, 'file-excerpt-0')">CORE/Cake/Routing/Dispatcher.php line 187</a> &rarr; <a href="#" onclick="traceToggle(event, 'trace-args-0')">Controller->invokeAction(CakeRequest)</a> <div id="file-excerpt-0" class="cake-code-dump" style="display:none;"><pre><code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$controller</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">startupProcess</span><span style="color: #007700">();</span></span></code>
 <code><span style="color: #000000"><span style="color: #0000BB"></span></span></code>
 <code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$render&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">true</span><span style="color: #007700">;</span></span></code>
 <span class="code-highlight"><code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$result&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">$controller</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">invokeAction</span><span style="color: #007700">(</span><span style="color: #0000BB">$request</span><span style="color: #007700">);</span></span></code></span>
 <code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">if&nbsp;(</span><span style="color: #0000BB">$result&nbsp;</span><span style="color: #007700">instanceof&nbsp;</span><span style="color: #0000BB">CakeResponse</span><span style="color: #007700">)&nbsp;{</span></span></code></pre></div> <div id="trace-args-0" class="cake-code-dump" style="display: none;"><pre>object(CakeRequest) {
 	params =&gt; array(
 		[maximum depth reached]
 	)
 	data =&gt; array([maximum depth reached])
 	query =&gt; array([maximum depth reached])
 	url =&gt; &#039;tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/&#039;
 	base =&gt; &#039;&#039;
 	webroot =&gt; &#039;/&#039;
 	here =&gt; &#039;/tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/&#039;
 	[protected] _detectors =&gt; array(
 		[maximum depth reached]
 	)
 	[protected] _input =&gt; &#039;&#039;
 }</pre></div></li>
 	<li><a href="#" onclick="traceToggle(event, 'file-excerpt-1')">CORE/Cake/Routing/Dispatcher.php line 162</a> &rarr; <a href="#" onclick="traceToggle(event, 'trace-args-1')">Dispatcher->_invoke(TasksController, CakeRequest, CakeResponse)</a> <div id="file-excerpt-1" class="cake-code-dump" style="display:none;"><pre><code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">));</span></span></code>
 <code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">}</span></span></code>
 <code><span style="color: #000000"><span style="color: #0000BB"></span></span></code>
 <span class="code-highlight"><code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$response&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">$this</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">_invoke</span><span style="color: #007700">(</span><span style="color: #0000BB">$controller</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">$request</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">$response</span><span style="color: #007700">);</span></span></code></span>
 <code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">if&nbsp;(isset(</span><span style="color: #0000BB">$request</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">params</span><span style="color: #007700">[</span><span style="color: #DD0000">'return'</span><span style="color: #007700">]))&nbsp;{</span></span></code></pre></div> <div id="trace-args-1" class="cake-code-dump" style="display: none;"><pre>object(TasksController) {
 	uses =&gt; array([maximum depth reached])
 	name =&gt; &#039;Tasks&#039;
 	helpers =&gt; array([maximum depth reached])
 	request =&gt; object(CakeRequest) {}
 	response =&gt; object(CakeResponse) {}
 	viewPath =&gt; &#039;Tasks&#039;
 	layoutPath =&gt; null
 	viewVars =&gt; array([maximum depth reached])
 	view =&gt; &#039;aaa&#039;;&lt;img src=&#039;a&#039; onerror=&#039;alert(&quot;XSS&quot;)&#039;&#039;
 	layout =&gt; &#039;default&#039;
 	autoRender =&gt; true
 	autoLayout =&gt; true
 	Components =&gt; object(ComponentCollection) {}
 	components =&gt; array(
 		[maximum depth reached]
 	)
 	viewClass =&gt; &#039;View&#039;
 	View =&gt; null
 	ext =&gt; &#039;.ctp&#039;
 	plugin =&gt; null
 	cacheAction =&gt; false
 	passedArgs =&gt; array([maximum depth reached])
 	scaffold =&gt; false
 	methods =&gt; array(
 		[maximum depth reached]
 	)
 	modelClass =&gt; &#039;Task&#039;
 	modelKey =&gt; &#039;task&#039;
 	validationErrors =&gt; null
 	Session =&gt; object(SessionComponent) {}
 	[protected] _responseClass =&gt; &#039;CakeResponse&#039;
 	[protected] _mergeParent =&gt; &#039;AppController&#039;
 	[protected] _eventManager =&gt; object(CakeEventManager) {}
 }
 object(CakeRequest) {
 	params =&gt; array(
 		[maximum depth reached]
 	)
 	data =&gt; array([maximum depth reached])
 	query =&gt; array([maximum depth reached])
 	url =&gt; &#039;tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/&#039;
 	base =&gt; &#039;&#039;
 	webroot =&gt; &#039;/&#039;
 	here =&gt; &#039;/tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/&#039;
 	[protected] _detectors =&gt; array(
 		[maximum depth reached]
 	)
 	[protected] _input =&gt; &#039;&#039;
 }
 object(CakeResponse) {
 	[protected] _statusCodes =&gt; array(
 		[maximum depth reached]
 	)
 	[protected] _mimeTypes =&gt; array(
 		[maximum depth reached]
 	)
 	[protected] _protocol =&gt; &#039;HTTP/1.1&#039;
 	[protected] _status =&gt; (int) 200
 	[protected] _contentType =&gt; &#039;text/html&#039;
 	[protected] _headers =&gt; array([maximum depth reached])
 	[protected] _body =&gt; null
 	[protected] _file =&gt; null
 	[protected] _fileRange =&gt; null
 	[protected] _charset =&gt; &#039;UTF-8&#039;
 	[protected] _cacheDirectives =&gt; array([maximum depth reached])
 	[protected] _cookies =&gt; array([maximum depth reached])
 }</pre></div></li>
 	<li><a href="#" onclick="traceToggle(event, 'file-excerpt-2')">APP/webroot/index.php line 110</a> &rarr; <a href="#" onclick="traceToggle(event, 'trace-args-2')">Dispatcher->dispatch(CakeRequest, CakeResponse)</a> <div id="file-excerpt-2" class="cake-code-dump" style="display:none;"><pre><code><span style="color: #000000"><span style="color: #0000BB">$Dispatcher</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">dispatch</span><span style="color: #007700">(</span></span></code>
 <code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">new&nbsp;</span><span style="color: #0000BB">CakeRequest</span><span style="color: #007700">(),</span></span></code>
 <code><span style="color: #000000"><span style="color: #0000BB">&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #007700">new&nbsp;</span><span style="color: #0000BB">CakeResponse</span><span style="color: #007700">()</span></span></code>
 <span class="code-highlight"><code><span style="color: #000000"><span style="color: #0000BB"></span><span style="color: #007700">);</span></span></code></span>
 <code><span style="color: #000000"><span style="color: #0000BB"></span></span></code></pre></div> <div id="trace-args-2" class="cake-code-dump" style="display: none;"><pre>object(CakeRequest) {
 	params =&gt; array(
 		[maximum depth reached]
 	)
 	data =&gt; array([maximum depth reached])
 	query =&gt; array([maximum depth reached])
 	url =&gt; &#039;tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/&#039;
 	base =&gt; &#039;&#039;
 	webroot =&gt; &#039;/&#039;
 	here =&gt; &#039;/tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/&#039;
 	[protected] _detectors =&gt; array(
 		[maximum depth reached]
 	)
 	[protected] _input =&gt; &#039;&#039;
 }
 object(CakeResponse) {
 	[protected] _statusCodes =&gt; array(
 		[maximum depth reached]
 	)
 	[protected] _mimeTypes =&gt; array(
 		[maximum depth reached]
 	)
 	[protected] _protocol =&gt; &#039;HTTP/1.1&#039;
 	[protected] _status =&gt; (int) 200
 	[protected] _contentType =&gt; &#039;text/html&#039;
 	[protected] _headers =&gt; array([maximum depth reached])
 	[protected] _body =&gt; null
 	[protected] _file =&gt; null
 	[protected] _fileRange =&gt; null
 	[protected] _charset =&gt; &#039;UTF-8&#039;
 	[protected] _cacheDirectives =&gt; array([maximum depth reached])
 	[protected] _cookies =&gt; array([maximum depth reached])
 }</pre></div></li>
 </ul>
 <script type="text/javascript">
 function traceToggle(event, id) {
 	var el = document.getElementById(id);
 	el.style.display = (el.style.display === 'block') ? 'none' : 'block';
 	event.preventDefault();
 	return false;
 }
 </script>
 		</div>
 		<div id="footer">
 			<a href="http://www.cakephp.org/" target="_blank"><img src="/img/cake.power.gif" alt="CakePHP: the rapid development php framework" border="0" /></a>		</div>
 	</div>
 	</body>
 </html>
	$ curl -k "https://cake.localhost.com/tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/"
	<!DOCTYPE html>
	<html>
	<head>
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>
	CakePHP: the rapid development php framework:
	Errors </title>
	<link href="/favicon.ico" type="image/x-icon" rel="icon" /><link href="/favicon.ico" type="image/x-icon" rel="shortcut icon" /><link rel="stylesheet" type="text/css" href="/css/cake.generic.css" /></head>
	<body>
	<div id="container">
	<div id="header">
	<h1><a href="http://cakephp.org">CakePHP: the rapid development php framework</a></h1>
	</div>
	<div id="content">


	<h2>Missing Method in TasksController</h2> <p class="error">
	<strong>Error: </strong>
	The action <em>aaa';<img src='a' onerror='alert("XSS")'</em> is not defined in controller <em>TasksController</em></p>
	<p class="error">
	<strong>Error: </strong>
	Create <em>TasksController::</em><em>aaa';<img src='a' onerror='alert("XSS")'()</em> in file: app/Controller/TasksController.php.</p>
	<pre>
	<?php
	class TasksController extends AppController {

	<strong>
	public function aaa';<img src='a' onerror='alert("XSS")'() {

	}
	</strong>
	}
	</pre>
	<p class="notice">
	<strong>Notice: </strong>
	If you want to customize this error message, create app/View/Errors/missing_action.ctp</p>
	<h3>Stack Trace</h3>
	<ul class="cake-stack-trace">
	<li><a href="#" onclick="traceToggle(event, 'file-excerpt-0')">CORE/Cake/Routing/Dispatcher.php line 187</a> → <a href="#" onclick="traceToggle(event, 'trace-args-0')">Controller->invokeAction(CakeRequest)</a> <div id="file-excerpt-0" class="cake-code-dump" style="display:none;"><pre><code><span style="color: #000000"><span style="color: #0000BB">        $controller</span><span style="color: #007700">-></span><span style="color: #0000BB">startupProcess</span><span style="color: #007700">();</span></span></code>
	<code><span style="color: #000000"><span style="color: #0000BB"></span></span></code>
	<code><span style="color: #000000"><span style="color: #0000BB">        $render </span><span style="color: #007700">= </span><span style="color: #0000BB">true</span><span style="color: #007700">;</span></span></code>
	<span class="code-highlight"><code><span style="color: #000000"><span style="color: #0000BB">        $result </span><span style="color: #007700">= </span><span style="color: #0000BB">$controller</span><span style="color: #007700">-></span><span style="color: #0000BB">invokeAction</span><span style="color: #007700">(</span><span style="color: #0000BB">$request</span><span style="color: #007700">);</span></span></code></span>
	<code><span style="color: #000000"><span style="color: #0000BB">        </span><span style="color: #007700">if (</span><span style="color: #0000BB">$result </span><span style="color: #007700">instanceof </span><span style="color: #0000BB">CakeResponse</span><span style="color: #007700">) {</span></span></code></pre></div> <div id="trace-args-0" class="cake-code-dump" style="display: none;"><pre>object(CakeRequest) {
	params => array(
	[maximum depth reached]
	)
	data => array([maximum depth reached])
	query => array([maximum depth reached])
	url => 'tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/'
	base => ''
	webroot => '/'
	here => '/tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/'
	[protected] _detectors => array(
	[maximum depth reached]
	)
	[protected] _input => ''
	}</pre></div></li>
	<li><a href="#" onclick="traceToggle(event, 'file-excerpt-1')">CORE/Cake/Routing/Dispatcher.php line 162</a> → <a href="#" onclick="traceToggle(event, 'trace-args-1')">Dispatcher->_invoke(TasksController, CakeRequest, CakeResponse)</a> <div id="file-excerpt-1" class="cake-code-dump" style="display:none;"><pre><code><span style="color: #000000"><span style="color: #0000BB">            </span><span style="color: #007700">));</span></span></code>
	<code><span style="color: #000000"><span style="color: #0000BB">        </span><span style="color: #007700">}</span></span></code>
	<code><span style="color: #000000"><span style="color: #0000BB"></span></span></code>
	<span class="code-highlight"><code><span style="color: #000000"><span style="color: #0000BB">        $response </span><span style="color: #007700">= </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_invoke</span><span style="color: #007700">(</span><span style="color: #0000BB">$controller</span><span style="color: #007700">, </span><span style="color: #0000BB">$request</span><span style="color: #007700">, </span><span style="color: #0000BB">$response</span><span style="color: #007700">);</span></span></code></span>
	<code><span style="color: #000000"><span style="color: #0000BB">        </span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$request</span><span style="color: #007700">-></span><span style="color: #0000BB">params</span><span style="color: #007700">[</span><span style="color: #DD0000">'return'</span><span style="color: #007700">])) {</span></span></code></pre></div> <div id="trace-args-1" class="cake-code-dump" style="display: none;"><pre>object(TasksController) {
	uses => array([maximum depth reached])
	name => 'Tasks'
	helpers => array([maximum depth reached])
	request => object(CakeRequest) {}
	response => object(CakeResponse) {}
	viewPath => 'Tasks'
	layoutPath => null
	viewVars => array([maximum depth reached])
	view => 'aaa';<img src='a' onerror='alert("XSS")''
	layout => 'default'
	autoRender => true
	autoLayout => true
	Components => object(ComponentCollection) {}
	components => array(
	[maximum depth reached]
	)
	viewClass => 'View'
	View => null
	ext => '.ctp'
	plugin => null
	cacheAction => false
	passedArgs => array([maximum depth reached])
	scaffold => false
	methods => array(
	[maximum depth reached]
	)
	modelClass => 'Task'
	modelKey => 'task'
	validationErrors => null
	Session => object(SessionComponent) {}
	[protected] _responseClass => 'CakeResponse'
	[protected] _mergeParent => 'AppController'
	[protected] _eventManager => object(CakeEventManager) {}
	}
	object(CakeRequest) {
	params => array(
	[maximum depth reached]
	)
	data => array([maximum depth reached])
	query => array([maximum depth reached])
	url => 'tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/'
	base => ''
	webroot => '/'
	here => '/tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/'
	[protected] _detectors => array(
	[maximum depth reached]
	)
	[protected] _input => ''
	}
	object(CakeResponse) {
	[protected] _statusCodes => array(
	[maximum depth reached]
	)
	[protected] _mimeTypes => array(
	[maximum depth reached]
	)
	[protected] _protocol => 'HTTP/1.1'
	[protected] _status => (int) 200
	[protected] _contentType => 'text/html'
	[protected] _headers => array([maximum depth reached])
	[protected] _body => null
	[protected] _file => null
	[protected] _fileRange => null
	[protected] _charset => 'UTF-8'
	[protected] _cacheDirectives => array([maximum depth reached])
	[protected] _cookies => array([maximum depth reached])
	}</pre></div></li>
	<li><a href="#" onclick="traceToggle(event, 'file-excerpt-2')">APP/webroot/index.php line 110</a> → <a href="#" onclick="traceToggle(event, 'trace-args-2')">Dispatcher->dispatch(CakeRequest, CakeResponse)</a> <div id="file-excerpt-2" class="cake-code-dump" style="display:none;"><pre><code><span style="color: #000000"><span style="color: #0000BB">$Dispatcher</span><span style="color: #007700">-></span><span style="color: #0000BB">dispatch</span><span style="color: #007700">(</span></span></code>
	<code><span style="color: #000000"><span style="color: #0000BB">    </span><span style="color: #007700">new </span><span style="color: #0000BB">CakeRequest</span><span style="color: #007700">(),</span></span></code>
	<code><span style="color: #000000"><span style="color: #0000BB">    </span><span style="color: #007700">new </span><span style="color: #0000BB">CakeResponse</span><span style="color: #007700">()</span></span></code>
	<span class="code-highlight"><code><span style="color: #000000"><span style="color: #0000BB"></span><span style="color: #007700">);</span></span></code></span>
	<code><span style="color: #000000"><span style="color: #0000BB"></span></span></code></pre></div> <div id="trace-args-2" class="cake-code-dump" style="display: none;"><pre>object(CakeRequest) {
	params => array(
	[maximum depth reached]
	)
	data => array([maximum depth reached])
	query => array([maximum depth reached])
	url => 'tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/'
	base => ''
	webroot => '/'
	here => '/tasks/aaa%27;%3Cimg%20src=%27a%27%20onerror=%27alert%28%22XSS%22%29%27/'
	[protected] _detectors => array(
	[maximum depth reached]
	)
	[protected] _input => ''
	}
	object(CakeResponse) {
	[protected] _statusCodes => array(
	[maximum depth reached]
	)
	[protected] _mimeTypes => array(
	[maximum depth reached]
	)
	[protected] _protocol => 'HTTP/1.1'
	[protected] _status => (int) 200
	[protected] _contentType => 'text/html'
	[protected] _headers => array([maximum depth reached])
	[protected] _body => null
	[protected] _file => null
	[protected] _fileRange => null
	[protected] _charset => 'UTF-8'
	[protected] _cacheDirectives => array([maximum depth reached])
	[protected] _cookies => array([maximum depth reached])
	}</pre></div></li>
	</ul>
	<script type="text/javascript">
	function traceToggle(event, id) {
	var el = document.getElementById(id);
	el.style.display = (el.style.display === 'block') ? 'none' : 'block';
	event.preventDefault();
	return false;
	}
	</script>
	</div>
	<div id="footer">
	<a href="http://www.cakephp.org/" target="_blank"><img src="/img/cake.power.gif" alt="CakePHP: the rapid development php framework" border="0" /></a> </div>
	</div>
	</body>
	</html>