Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103196
MIME-Version: 1.0
Date: Thu, 20 Sep 2018 12:37:37 +0200
Message-ID: <CANZOY=C6Zmh4QdxQvyzkErqPrJ0R-Xwq8ye9MYQmE085=n71cQ@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000bde9c605764b26c3"
Subject: Add FILTER_VALIDATE_INCLUDE validation filter for variable includes
From: arnold.adaniels.nl@gmail.com (Arnold Daniels)

--000000000000bde9c605764b26c3
Content-Type: text/plain; charset="UTF-8"

There are many security issues that arise from not sanitizing a variable
before using it in an include (eg `include $script;`).

The filter extension is intended to prevent this kind of security issues. A
validation filter would make it easier and could be the defacto standard
when using variable includes.

When a static code analyzer is used, it can check if the filter has been
used and the variable is safe to be used in include.

The options could be "base_path, allowed_streams".

The base_path option defines the path where the file should be in. Dots
like `..` are resolved. Home paths, like `~/foo` and `~arnold/` are not
allowed (or resolved). Symlinks are not considered.

The `allowed_streams` option would set which streams are allowed. By
default none. I feel this is a better option than relying on
'allow_url_include' or RFC: Precise URL include control (
https://wiki.php.net/rfc/allow_url_include).

    include filter_var($script, FILTER_VALIDATE_INCLUDE, ["base_path" =>
"path/to/project/", "allowed_streams" => ["phar", "zip"]]);

What do you think?

Also, does this require an RFC or should I just create a PR?

- Arnold

--000000000000bde9c605764b26c3--