Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107868
MIME-Version: 1.0
References: <CAAupm8h5Aa4EmnGnHX1iVgcQTCpmW-3yD4e6m7aouZFiSCtGrA@mail.gmail.com>
 <A7F945D0-C227-462C-9505-159EBA78B979@gmail.com> <CAAupm8j7TZHq7eD2UdbvgEGSsZ46M3gmLakMPZ7W-3qnq5=KBA@mail.gmail.com>
 <F8234340-2D99-4F65-A8BA-8D208A2C98DE@newclarity.net>
In-Reply-To: <F8234340-2D99-4F65-A8BA-8D208A2C98DE@newclarity.net>
Date: Tue, 26 Nov 2019 15:54:49 -0600
Message-ID: <CAAupm8gsUbAPNgXTFGqaL-qjOqZwxBM0zx8UMzUXKBC4hb7bzQ@mail.gmail.com>
To: Mike Schinkel <mike@newclarity.net>
Cc: PHP internals <internals@lists.php.net>, Benjamin Morel <benjamin.morel@gmail.com>
Content-Type: multipart/alternative; boundary="0000000000008b08a6059846ee2a"
Subject: Re: [PHP-DEV] Let's allow eval() to be turned off in PHP 8
From: iansltx@gmail.com (Ian Littman)

--0000000000008b08a6059846ee2a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

create_function() will be gone as of PHP 8 anyway. For eval(), e.g. psysh
uses it (and, as a result, e.g. Laravel Tinker). So defaulting eval to
disabled doesn't seem tenable. Not what I'm asking anyway...I just want the
*ability* to turn it off (likely only in apache/fpm configs actually,
leaving it on for the CLI).

On Tue, Nov 26, 2019 at 3:44 PM Mike Schinkel <mike@newclarity.net> wrote:

> On Nov 26, 2019, at 11:27 AM, Ian Littman <iansltx@gmail.com> wrote:
>
>
> You're right that turning off eval() isn't a silver bullet, and if you ca=
n
> get external code running on someone's box there are a lot worse things y=
ou
> can do.
>
> On Tue, Nov 26, 2019 at 10:11 AM Benjamin Morel <benjamin.morel@gmail.com=
>
> wrote:
>
> Hi Ian,
>
> IMO, eval() is secure, as long as:
>
> - you=E2=80=99re not using it, or
> - you=E2=80=99re using it properly
>
> I=E2=80=99d say that as soon as your server has been compromised, eval() =
is the
> last of your worries, as pretty much anything becomes possible, including
> writing PHP code to a file and including/executing it. So I feel like
> disabling eval() will just make =C2=AB hackers =C2=BB have a good laugh
>
>
>
> There *might* be a good argument for turning it eval() and
> create_function() off by default for command-line use?
>
> #jmtcw
>
> -Mike
>
>

--0000000000008b08a6059846ee2a--