Security Hardening - sebiboga/testlink-upgraded GitHub Wiki

Security Hardening Guide

Security fixes and improvements applied to TestLink v1.9.20.

SQL Injection Prevention (#172)

Issue

SQL injection vulnerabilities in search functionality.

Fixed Fields

  • Date field validation (creationdatefrom)
  • User filter fields (createdby, editedby)
  • Advanced search filters

Solution

function validateDate($dateToValidate, $format = 'Y-m-d')
{
  $d = DateTime::createFromFormat($format, $dateToValidate);
  return $d && $d->format($format) === $dateToValidate;
}

Protected Areas

  • Test case search
  • Advanced search filters
  • Result filters
  • Date range inputs

CSRF Protection (#174)

Issue

Cross-Site Request Forgery vulnerability in role management.

Fixed: Role Deletion

// Only non-system roles can be deleted
if($args->roleid > TL_LAST_SYSTEM_ROLE) {   
  $userFeedback = deleteRole($db, $args->roleid);
  checkSessionValid($db);  // Refresh user session
}

Protection

  • System roles protected (IDs 1-4)
  • Custom roles deletable
  • Session validation after operations

Input Validation (#179)

Type Safety

Proper type casting for PHP 8 compatibility:

// Safe array operations
$items = (array)$query_result;
$count = count($items);  // Never throws TypeError

// Using helper functions
$count = tlCount($items);  // Returns 0 for non-arrays
$items = tlEnsureCountable($data);  // Guarantees array

Null Handling

All potential null inputs are validated:

if(!is_null($value) && is_array($value)) {
  process($value);
}

Security Best Practices

1. Input Validation

  • Always validate user input
  • Use type casting for safety
  • Check for null values before processing

2. SQL Queries

  • Use parameterized queries
  • Validate date/number inputs
  • Escape string values

3. CSRF Protection

  • Check session validity
  • Verify role permissions
  • Log security operations

4. Error Handling

  • Don't expose sensitive information
  • Log security events
  • Return generic error messages to users

Testing Security

Test SQL Injection

1' OR '1'='1
'); DROP TABLE users; --
1 UNION SELECT * FROM users

Should all be rejected or properly escaped.

Test CSRF

Attempt operations without valid session should fail.

Test Type Safety

Send invalid data types to ensure proper handling.

Audit Checklist

  • Validate all user input
  • Use type-safe functions
  • Check role permissions
  • Validate dates and numbers
  • Log security operations
  • Review error messages
  • Test with malicious input

Related Documentation

Status: ✅ Hardened
Issues: #172 (SQL Injection), #174 (CSRF), #179 (Input Validation)