Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:100183
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.181 as permitted sender)
MIME-Version: 1.0
Date: Fri, 11 Aug 2017 15:15:46 +0200
Message-ID: <CAF+90c8WVZAT=kaVqEB-V+kCJdtBV47dMv+uUP2hiecFRPEx0Q@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a113f9a7879486805567a1c71"
Subject: WDDX serialization and security
From: nikita.ppv@gmail.com (Nikita Popov)

--001a113f9a7879486805567a1c71
Content-Type: text/plain; charset="UTF-8"

Hi internals,

Same question here as with unserialize().
https://bugs.php.net/bug.php?id=75007 has recently been classified as not a
security bug, because WDDX should not be fed untrusted data.

To provide some context here, our WDDX implementation is generally
vulnerable to object injection (it is possible to create arbitrary objects,
resulting in exploitable calls to __wakeup, __destruct, __toString and
similar), but it does not have the other security issues of unserialize (in
particular, no references).

My question is now: What's the point of having this functionality at all?
As far as I can discern, WDDX seems to be targeted as a data interchange
format (something where trust generally cannot be assumed), but the way we
implement it (with support for object creation), it cannot be used as such.

As such, these functions seem pretty useless right now. You can't use them
for data interchange due to security issues, and it's not the serialization
functionality you would use for local storage (for all it's issues,
serialize() is still a much better choice for that purpose.)

I'm wondering if it might be time to remove (i.e. deprecate and move to
PECL) the wddx extension?

Regards,
Nikita

--001a113f9a7879486805567a1c71--