8

We have the following three tags:

  • , 36 questions:

    A remote code execution attack where user input is used to build the path of code files to be executed, allowing an attacker to control which code is executed. Most commonly affects web applications that rely on a scripting run time, most commonly PHP.

  • , 9 questions, no guidance.

  • , 1 question:

    Local File Inclusion (also known as LFI) allows an attacker to include files in server-side through the web browser. LFI is commonly found to affect web applications that rely on a scripting runtime. This occurs mainly due to a bad input validation mechanism, wherein the user’s input is passed to the file include commands without proper validation.

I feel like these should not be three but two or one. Any suggestions for what to make a synonym of what and what usage quidance to use?

1

1 Answer 1

Reset to default
5

I agree there is a very straightforward argument for having lfi as a synonym of local-file-inclusion, but file-inclusion should probably be renamed to remote-file-inclusion.

File-inclusion itself should probably be made a synonym of one or the other... I would suggest that it be a synonym of remote-file-inclusion, ust based on numbers of questions.

7
  • 1
    If it is not clear if "file inclusion" without a prefix is "remote" or "local", I would argue that the tag should not exist at all and we should force people to pick either "remote" or "local". (But to be honest, I have forgot what these words really mean so do not take me to seriously.)
    – Anders
    Aug 24, 2020 at 12:41
  • 1
    Do you think it is important to differentiate at the tag level, between remote- and local- file inclusion? how about we alias both of them (along with lfi and rfi) to just plain "file-inclusion"? The idea is still the same...
    – AviD Mod
    Sep 1, 2020 at 9:25
  • @AviD I don't understand the difference, so for me making it all an alias is fine. But that I don't understand the difference doesnt mean there isn't one off course.
    – Anders
    Sep 7, 2020 at 16:42
  • @Anders so my point was if we make an alias/synonym, they are all really the same single tag ("file-inclusion"), and even if you choose one of the others it will revert to the main tag. As opposed to having separate tags, eg "remote-file-inclusion" and "local-file-inclusion"
    – AviD Mod
    Sep 8, 2020 at 10:27
  • @AviD Sorry, I meant I didn't understand the difference between remote and local file inclusion. :-) I am OK with making all the tags an alias of file-inclusion. But as is evident, I am no export.
    – Anders
    Sep 8, 2020 at 11:11
  • @Anders ahh well then that just backs up what I'm saying, though there is a clear and obvious difference (if the file is local, or remote ;-) ) the effective difference is negligible :-) WDYT Rory?
    – AviD Mod
    Sep 9, 2020 at 15:21
  • Should we go ahead and fix this? I'm leaning towards just file-inclusion, but I am open to other solutions to.
    – Anders
    Oct 13, 2020 at 11:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .