Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103210
MIME-Version: 1.0
In-Reply-To: <CANZOY=B-2igFBVCYGDrZT2a11B0xMXRNeWPXh6jxT_EZ_O2LUQ@mail.gmail.com>
References: <CANZOY=C6Zmh4QdxQvyzkErqPrJ0R-Xwq8ye9MYQmE085=n71cQ@mail.gmail.com>
 <CAPhkiZyvaEg19WS5wXTU=1MwaKHu1=w0qYPfpV1Ex9nv_9LEpA@mail.gmail.com> <CANZOY=B-2igFBVCYGDrZT2a11B0xMXRNeWPXh6jxT_EZ_O2LUQ@mail.gmail.com>
Date: Thu, 20 Sep 2018 21:50:33 +0300
Message-ID: <CAPhkiZwDYEjG9wz0exMQcv3dAXApHEa6BJ-AULqq_kYt=ur-VQ@mail.gmail.com>
To: Arnold Daniels <arnold@jasny.net>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for
 variable includes
From: narf@devilix.net (Andrey Andreev)

Hi again,


On Thu, Sep 20, 2018 at 5:29 PM, Arnold Daniels <arnold@jasny.net> wrote:
>
> Variable includes have proper purposes, like for a (PSR-4) autoloader. This
> can't be simply replaced with an 'if' statement. Other reasons are module
> inclusion and generated code.
>

Of course, there are a few valid applications even for the most
discouraged practices - in that you are correct. But you should know I
meant *user input* variable inclusion in particular.
Either way, I don't see how a *user input filter* validator would help
PSR-4, generated code and/or whatever you meant by module inclusion.

Just to be clear, in everything I'm saying, I assume you want to solve
the following problem:

    include $_GET['page'].".php"; // <-- vulnerability

(simplified, of course)

> Variable inclusion is already done very often. I don't think this filter
> will persuade people to do it that would otherwise not. This is a common
> security issue. So if variable inclusion isn't disabled in full, having a
> common way to prevent such issues seem like a good idea to me.
>

Well, I've got two things to say about this:

1. The developers who intruduce such vulnerabilities are the ones who
don't do validation in the first place, so the way I see it, the few
poor souls who might benefit from your proposal wouldn't care for it
anyway.
2. Reiterating from my previous reply, this would only serve as an
excuse for some to say that user input variable inclusion is an OK
thing to do, because "see, PHP has a tool specifically for it, so it
must be good".

>> Sanitization is more often than not imperfect and there's always the
>> potential to bypass it.
>
> This would be a validation filter and not a sanization filter. Can you give
> an example on how you could bypass it?
>

Sorry, you started the discussion by mentioning sanitization and I
just went with it without noticing the details.

Still, even as a validator this can be bypassed depending on the
application architecture - sure, you specify a base path, but who is
to say I'm not trying to RCE via something within that base path?

Cheers,
Andrey.