English 中文(简体)
我是否应该担心再次占领者的袭击?
原标题:Should I be worried about a ReDOS attack?
  • 时间:2011-11-23 00:09:44
  •  标签:
  • php
  • security

http://sla.ckers.org/forum/read.php?14,31355,31355“rel=“nofollow” 攻击我的现场?

或者,当<代码>最大限度_execution_time被超越或是否成为过去的问题时,这一条才会终止?

I use the following code to validate emailaddresses on my sites (by Douglas Lovell):

function validate_email($email)
{
   $isValid = true;
   $atIndex = strrpos($email, "@");
   if (is_bool($atIndex) && !$atIndex)
   {
      $isValid = false;
   } else {
      $domain = substr($email, $atIndex+1);
      $local = substr($email, 0, $atIndex);
      $localLen = strlen($local);
      $domainLen = strlen($domain);
      if ($localLen < 1 || $localLen > 64)
      {
         // local part length exceeded
         $isValid = false;
      }
      else if ($domainLen < 1 || $domainLen > 255)
      {
         // domain part length exceeded
         $isValid = false;
      }
      else if ($local[0] ==  .  || $local[$localLen-1] ==  . )
      {
         // local part starts or ends with  . 
         $isValid = false;
      }
      else if (preg_match( /\.\./ , $local))
      {
         // local part has two consecutive dots
         $isValid = false;
      }
      else if (!preg_match( /^[A-Za-z0-9\-\.]+$/ , $domain))
      {
         // character not valid in domain part
         $isValid = false;
      }
      else if (preg_match( /\.\./ , $domain))
      {
         // domain part has two consecutive dots
         $isValid = false;
      }
      else if(!preg_match( /^(\\.|[A-Za-z0-9!#%&`_=\/$ *+?^{}|~.-])+$/ , str_replace("\\","",$local))) {
         // character not valid in local part unless
         // local part is quoted
         if (!preg_match( /^"(\\"|[^"])+"$/ , str_replace("\\","",$local))) {
            $isValid = false;
         }
      }
      if ($isValid && !(checkdnsrr($domain,"MX") || checkdnsrr($domain,"A")))
      {
         // domain not found in DNS
         $isValid = false;
      }
   }

   return $isValid;
}
最佳回答

您在此重复使用的任何定期表述都无过长时间。

但是,从名称来看,<代码>checkdnsrr(>),如果域名人不作回应,则可能采取这种做法。 确保其时间不变。

问题回答

暂无回答




相关问题
Signed executables under Linux

For security reasons, it is desirable to check the integrity of code before execution, avoiding tampered software by an attacker. So, my question is How to sign executable code and run only trusted ...

MALICIOUS_CODE EI_EXPOSE_REP Medium

I run findbugs against all of my code and only tackle the top stuff. I finally got the top stuff resolved and now am looking at the details. I have a simple entity, say a user: public class User ...

XSS on jsbin.com

Anyone know if jsbin.com implements any protection for XSS or other javascript attacks? I see jsbin links used fairly regularly on sites like this one and I can t find any indication from the site ...

Make md5 strong

Im making a website that will intergrate with game that only support md5 hashing metod (atm). Which ofc is not especially safe anymore. But how could i make it stronger? Should I just generate long ...

Why running a service as Local System is bad on windows?

I am trying to find out the difference between difference service account types. I tumbled upon this question. The answer was because it has powerful access to local resources, and Network Service ...

Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

热门标签