Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102091
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAN+C6bU3BJRmKpxLjaXMaJOKbKq1-+uG-=+xHQn=dSumsk_JPg@mail.gmail.com>
References: <CAN+C6bU3BJRmKpxLjaXMaJOKbKq1-+uG-=+xHQn=dSumsk_JPg@mail.gmail.com>
Date: Thu, 3 May 2018 20:49:40 -0300
Message-ID: <CALSrLtZ8eQNbrf_uW5k2QLtBaHf+ipL++iyWJP3n0O0kZMc24g@mail.gmail.com>
To: Tom Van Looy <tom@ctors.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] More secure credentials storage
From: diogo86@gmail.com (Diogo Galvao)

2018-05-03 15:29 GMT-03:00 Tom Van Looy <tom@ctors.net>:
> Hi
...
> The problem I see with this practice is that it is so easy to leak
> environment variables. Like if you are running a phpinfo() page somewhere
> that is not a very big deal until it contains all your passwords and API
> keys in plain text. Jikes!
...
> The main intention is to get the credentials out of the environment
> variables. You need to setup a connection to a database or API? Get a
> password from the secure storage, make the connection and get rid of the
> password.

Wouldn't it be more feasible to assign the environment variables locally
then clear them from the environment for the rest of the process?


$password = getenv("PASSWORD");
var_dump($password);

putenv("PASSWORD=");

$password = getenv("PASSWORD");
var_dump($password);
phpinfo();


The manual of getenv() does warn that "If PHP is running in a SAPI such
as Fast CGI, this function will always return the value of an
environment variable set by the SAPI, even if putenv() has been used to
set a local environment variable of the same name." And there's also
apache_getenv() and apache_setenv() to worry about.

But if the point is to avoid accidental leaks, you may want to tackle
the problem from this perspective instead of using a new env mechanism.