Are requests to diagnose a known security problem on-topic?

In PHP mail form is being abused, the question asks for help finding how an e-mail script got exploited.

Finding problems is normally within the scope of Code Review, and we routinely point out security problems even if the author doesn't ask about it.

However, does this question violate the "working code, to the best of my knowledge" requirement? What should be done with it?

• The comments were cleaned up, but wasn't there a comment by OP indicating that they didn't understand the code? – Schism Aug 5 '14 at 16:57
• @Schism The comments were just adding confusion. The situation is clear from the question itself: OP wrote the code, but was told by a sysadmin that it had a security vulnerability. OP doesn't know what that vulnerability is. – 200_success Aug 5 '14 at 17:02

3 Answers

To me, it is analogous to asking for a performance optimization when we know the code doesn't work with a big file. Take this question as an example Replacing non-ASCII characters, we know that his code will fail with big input but it still on-topic.

In this case, the code is sending mail, but there is a known security issue.

I would say that if the user includes the information in the show_error function, that this should be on topic, we could point out where vulnerabilities are, they aren't bugs that keep the application from doing what it was programmed to do.

This isn't a debugging exercise. It's more of an optimization exercise.

I am casting a Reopen Vote.

Looking at the message it looks like the recipient just doesn't exist, it looks like a fake E-mail was put in.

It seems to me like the OP is asking about code not yet written when he says "I am trying to figure out a way to secure this form so that individuals cannot abuse this form and send mail to others through it." If he said he was looking for ways to improve the security, then it could be a review. Seems to me that he is looking for suggestions for how to implement security in the first place, and that would be a better fit elsewhere like SO.

• Like someone who have a problem with a big file will specifically say that he need to optimize that part. I don't understand how looking for suggestions for how to implement (I would say improve) security would be different than looking for way to optimize performance. Maybe the question could be improved in the way it said but I don't think it's differ that much from an optimization question (which is on-topic) – Marc-Andre Aug 5 '14 at 19:36