Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:100225
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.177 as permitted sender)
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <CAF+90c9-irX2gCu_858nQwQ-ARshwbV_8mtNAN-UMBgSvXVp0w@mail.gmail.com>
 <f59a0ba5-228b-88ed-bb99-d296684726c1@gmail.com>
 <CAF+90c_RUYwFgXK6rYvspvm1w+MUaeimRVzMJzHyWVj_t3oYXA@mail.gmail.com>
 <CAF+90c-PumhFT0spXrLfEDZ-R3pY+HRAnuX+2m_aOu=RJ6qOJQ@mail.gmail.com>
 <CAF+90c_wia6tzOTY3RV+X=BWOfmyBjO-JpTN_omX++8r9ikLOg@mail.gmail.com>
Message-ID: <5d80894b-966f-e63c-4000-3fc0c8d2161b@gmail.com>
Date: Tue, 15 Aug 2017 22:02:37 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <CAF+90c_wia6tzOTY3RV+X=BWOfmyBjO-JpTN_omX++8r9ikLOg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Unserialize security policy
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> The two main points are:
> 1. While it's true that if you're using unserialize() on untrusted input
> you are most likely going to be vulnerable due to object injection, it may
> be quite hard for an attacker to exploit this for closed source

Objects are not the problem (unless it's internal objects, in which case
the extension/code authors should have known better, but frequently
don't). References are huge problem, there are too many scenarios where
references can be made completely broken with bad serializing data.

> 2. We should be able to precipitate most unserialize() bugs by regularly
> fuzzing it ourselves. The setup for doing so is also provided.

That assumes that problems in unserialize() stem from some accidental
errors like off-by-one here and there. I don't think it's the case - I
think that given references support, it may not be possible to make it
robust against every hostile input without completely rewriting the
whole code, and even then I'm not sure it's possible. References can
create links between unrelated data items, which may lead to very subtle
problem with semantics inside objects, etc. which current code is just
not prepared to handle.

-- 
Stas Malyshev
smalyshev@gmail.com