Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104438
To: PHP internals <internals@lists.php.net>
Message-ID: <46354329-38ca-82a2-352d-71394e0ce6bd@gmx.de>
Date: Fri, 15 Feb 2019 15:00:52 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.5.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 8bit
Subject: =?UTF-8?Q?Mitigate_=e2=80=9cMagellan_vulnerabilitites=e2=80=9d_in_P?=
 =?UTF-8?Q?HP_7=2e2=3f?=
From: cmbecker69@gmx.de ("Christoph M. Becker")

Hi!

You may have heard about the so called “Magellan vulnerabilities”[1]
which potentially affect scripts which allow untrusted users to execute
almost arbitrary SQL queries.  BohwaZ provided a pull request[2] which
introduces an ini setting which enables defenses built-in to SQLite ≥
3.26.0 against the corruption of tables via SQL.

In my opinion, adding this ini setting to PHP-7.4 is a no brainer, but I
suggest that we backport it to PHP-7.2 as well.

And likely we should offer something of this kind for PDO as well.  Not
sure if a driver specific ini setting would be suitable.  Suggestions
welcome!

Thoughts?

[1] <https://blade.tencent.com/magellan/index_en.html>
[2] <https://github.com/php/php-src/pull/3709>

-- 
Christoph M. Becker