Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107873
MIME-Version: 1.0
References: <CAAupm8h5Aa4EmnGnHX1iVgcQTCpmW-3yD4e6m7aouZFiSCtGrA@mail.gmail.com>
 <05388310-2c80-2b42-a564-0fda2b6a2396@gmail.com> <CAAupm8gDxAjiW0Ox7jWAC0fEKUwSwYPA27NjHUawTVFd8RDc1w@mail.gmail.com>
 <CAG9XoMRf9kEQ2xFOZ_jVxmdxgg3qa4e5iyDc9ZN2rN2C3UktRg@mail.gmail.com>
In-Reply-To: <CAG9XoMRf9kEQ2xFOZ_jVxmdxgg3qa4e5iyDc9ZN2rN2C3UktRg@mail.gmail.com>
Date: Wed, 27 Nov 2019 00:20:32 +0100
Message-ID: <CADyq6sJzCh+FkaUSQA_2qMeB7W-MoySc5xka_ahNJ3zzi_rJMQ@mail.gmail.com>
To: Benjamin Morel <benjamin.morel@gmail.com>
Cc: Ian Littman <iansltx@gmail.com>, Stanislav Malyshev <smalyshev@gmail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000020a89e0598482180"
Subject: Re: [PHP-DEV] Let's allow eval() to be turned off in PHP 8
From: ocramius@gmail.com (Marco Pivetta)

--00000000000020a89e0598482180
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Assuming preloading (big assumption), disabling `eval()` as well as
`include*` and `require*` would probably close off most RCEs.

That would break a lot of stuff, but it would certainly make for a very
interesting experiment.

On Wed, Nov 27, 2019, 00:09 Benjamin Morel <benjamin.morel@gmail.com> wrote=
:

> >
> > One interesting thing with item #1 is that it allows for remote arbitra=
ry
> > code execution even if no include-able path on a server is writable. Th=
is
> > comes into play if there's a supply chain attack on your app. Say, an
> > infected update on a CMS plugin. Get an eval() of a file_get_contents()
> of
> > a URL into the code and...well, you get code execution that (if you're
> > lucky) only leaves a trace in logs. If you have to write a file somewhe=
re
> > first, then include it, you've got a bit more of a footprint.
>
>
>
> You don't have to hit disk, or have any writable path. You can just creat=
e
> a stream wrapper <https://www.php.net/manual/en/class.streamwrapper.php>
> that stores the "files" in memory, and include them as you would include =
a
> regular file.
>
>
> Can you work around these restrictions? Yep, but it takes a bit more effo=
rt
> > than the current setup. It doesn't make a server secure by any stretch,
> but
> > it reduces its attack surface slightly, and reduces the universe of
> > malicious code that won't error out, forcing malefactors to work just a
> bit
> > harder.
>
>
>
> Disabling eval() really doesn't reduce the attack surface at all, if you
> ask me. Malefactors will quickly & easily adapt their tools, that script
> kiddies will use as before.
>
>
> =E2=80=94 Benjamin
>

--00000000000020a89e0598482180--