如何避免drupal隐藏字段上的缓冲区溢出？

Question

I did a test run on a finished website using IBM Appscan and it returned a bunch of errors with a lot to do with the drupal search form block. Here's an extract of one of the errors:

    [13 of 37] Parameter Value Overflow
Severity: High
Test Type: Application Invasive
Vulnerable URL: http://[my-web-address]/contact
CVE ID(s): N/A
CWE ID(s): 120
Remediation Tasks: Limit the length of input fields to avoid buffer overflow
Variant 1 of 5 [ID=97491]
The following changes were applied to the original request:
• Set parameter 'form_build_id's value to
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAA...
**Request/Response:**
This request/response contains binary content, which is not included in generated
reports.
**Validation In Response:**
N/A
**Reasoning:**
The test caused the server to stop responding (an erroneous response was returned, such as cut
connection or time out). The original request was then resent and also failed, confirming that the
server had stopped responding.

Appreciate any pointers on what needs to be done, thanks.

Answer 1

If you use language of the form input other than English it is better to use mb_substr() function, which preserves strange characters like é, ù, etc... (almost like kirilloid solution) and filter_var() function, which strip tags and optionally strip or encode special characters in order to protect yourself from different types of injection attacks.

$form_build_id = mb_substr(filter_var($_GET['form_build_id'],FILTER_SANITIZE_STRING), 0, 100);

Here are the mb_substr() details and here filter_var() details. Note that mb_substr() requires PHP version 4.0.6 or higher and filter_var() function requires PHP version 5.2 or higher.