Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107867
Message-ID: <F8234340-2D99-4F65-A8BA-8D208A2C98DE@newclarity.net>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_8A601184-2F47-4955-9965-A64C0E0AA126"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Tue, 26 Nov 2019 16:44:15 -0500
In-Reply-To: <CAAupm8j7TZHq7eD2UdbvgEGSsZ46M3gmLakMPZ7W-3qnq5=KBA@mail.gmail.com>
Cc: Benjamin Morel <benjamin.morel@gmail.com>
To: Ian Littman <iansltx@gmail.com>,
 PHP internals <internals@lists.php.net>
References: <CAAupm8h5Aa4EmnGnHX1iVgcQTCpmW-3yD4e6m7aouZFiSCtGrA@mail.gmail.com>
 <A7F945D0-C227-462C-9505-159EBA78B979@gmail.com>
 <CAAupm8j7TZHq7eD2UdbvgEGSsZ46M3gmLakMPZ7W-3qnq5=KBA@mail.gmail.com>
Subject: Re: [PHP-DEV] Let's allow eval() to be turned off in PHP 8
From: mike@newclarity.net (Mike Schinkel)

--Apple-Mail=_8A601184-2F47-4955-9965-A64C0E0AA126
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

> On Nov 26, 2019, at 11:27 AM, Ian Littman <iansltx@gmail.com> wrote:
>=20
> You're right that turning off eval() isn't a silver bullet, and if you =
can
> get external code running on someone's box there are a lot worse =
things you
> can do.
>=20
> On Tue, Nov 26, 2019 at 10:11 AM Benjamin Morel =
<benjamin.morel@gmail.com>
> wrote:
>=20
>> Hi Ian,
>>=20
>> IMO, eval() is secure, as long as:
>>=20
>> - you=E2=80=99re not using it, or
>> - you=E2=80=99re using it properly
>>=20
>> I=E2=80=99d say that as soon as your server has been compromised, =
eval() is the
>> last of your worries, as pretty much anything becomes possible, =
including
>> writing PHP code to a file and including/executing it. So I feel like
>> disabling eval() will just make =C2=AB hackers =C2=BB have a good =
laugh


There might be a good argument for turning it eval() and =
create_function() off by default for command-line use?

#jmtcw

-Mike


--Apple-Mail=_8A601184-2F47-4955-9965-A64C0E0AA126--