Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:100211
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.15.18 as permitted sender)
To: Zeev Suraski <zeev@zend.com>, Nikita Popov <nikita.ppv@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <CAF+90c8WVZAT=kaVqEB-V+kCJdtBV47dMv+uUP2hiecFRPEx0Q@mail.gmail.com>
 <4ca2906e-4117-9773-d2bd-c17e27425a90@gmx.de>
 <CAF+90c8AT-xwWGdVyMTSSAUNPVSF1qv9Sga9z68f=0Zm=457Cw@mail.gmail.com>
 <BY2PR02MB298BD40845853A3A5177B46AC8C0@BY2PR02MB298.namprd02.prod.outlook.com>
Message-ID: <145aa0ba-6450-b8da-e4ed-542f70332034@gmx.de>
Date: Tue, 15 Aug 2017 01:53:03 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <BY2PR02MB298BD40845853A3A5177B46AC8C0@BY2PR02MB298.namprd02.prod.outlook.com>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Re: WDDX serialization and security
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 14.08.2017 at 13:04, Zeev Suraski wrote:

> On Sunday, August 13, 2017 6:53 PM, Nikita Popov wrote:
> 
>> On Sun, Aug 13, 2017 at 5:08 PM, Christoph M. Becker
>> <cmbecker69@gmx.de> wrote:
>> 
>>> On 11.08.2017 at 15:15, Nikita Popov wrote:
>>> 
>>>> I'm wondering if it might be time to remove (i.e. deprecate and
>>>> move to PECL) the wddx extension?
>>> 
>>> Hmm, that would leave a pretty useless extension in PECL.  An 
>>> alternative might be to remove support for objects and the wddx 
>>> session serialization handler.  This might even be done as bug
>>> fix if a respective ini option would be introduced.  We could
>>> still move the extension to PECL afterwards.
>> 
>> I'm only suggesting a move to PECL because that seems to be our
>> standard procedure when removing extensions.
>> 
>> Given that WDDX as a data interchange format seems pretty much
>> dead, I don't think it's worth trying to "fix" it in some way,
>> especially a way that breaks backwards compatibility. Even without
>> the additional security considerations, I would say it's long
>> overdue to unbundle this extension.
> 
> I would lean towards doing both: 
>
> 1. Move it to PECL as you suggest -
> regardless of the security element, as you say, it's long overdue for
> unbundling. 
>
> 2. Disable the object support in it as Christoph and Stas
> suggest, so that it's not completely useless (i.e. inherently
> insecure) in PECL. Admittedly I haven't looked at the code but I
> imagine that can't be too complex..?

FWIW, I've did this in my wddx branch, see
<https://github.com/cmb69/php-src/tree/wddx>.

> Given the security implications (the positive ones, that is), I would
> seriously consider doing that for 7.2 despite the very late point in
> time.

It might be sensible to only *deprecate* object unserialization for 7.2,
and to (re)move the WDDX extension in 7.3.  After all, we already tell
users that `wddx_deserialize()` should not be used on untrusted input:

* <http://docs.php.net/manual/en/intro.wddx.php>
* <http://docs.php.net/manual/en/function.wddx-deserialize.php>

Either way, we most certainly need an RFC to proceed…

-- 
Christoph M. Becker