Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112365
Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.4\))
In-Reply-To: <d0b78b71-e8f3-0e50-c934-71aa8fc2cfe1@rhsoft.net>
Date: Wed, 2 Dec 2020 09:18:40 +0100
Cc: PHP Internals List <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <23E6CF0B-77EF-4358-9576-BCB7919154A5@cschneid.com>
References: <b845d5bf-63da-d564-1f0f-cc934188d693@aimeos.com>
 <b546b5bf-27f8-62cc-cc4b-d859132998a4@gmx.de>
 <CAN2symjht9iZLDhYEKCYb9V7B4xEoHBG8MFMoAVQS55OKzWC7Q@mail.gmail.com>
 <CAFPFaM+Np_jQgDFr8vV8TofYyLMZ0EDWmt3+yr1_KQzJTbW6MQ@mail.gmail.com>
 <CAFPFaMLULyFB0R14rQGCPmzZdXUSg81rHJQEQPRK2C6tDK6__w@mail.gmail.com>
 <cf5d6d15-a50c-caba-79fd-a615391121dc@aimeos.com>
 <3dd3c22d-0959-5425-46b1-dade4ac75b00@rhsoft.net>
 <f433784d-41bf-6a22-e34b-4d0f8b57f925@gmail.com>
 <d0b78b71-e8f3-0e50-c934-71aa8fc2cfe1@rhsoft.net>
To: "Reindl Harald (privat)" <harry@rhsoft.net>
Subject: Re: [PHP-DEV] PHP 8 is_file/is_dir input handling
From: cschneid@cschneid.com (Christian Schneider)

Am 01.12.2020 um 21:13 schrieb Reindl Harald (privat) =
<harry@rhsoft.net>:
> Am 01.12.20 um 21:09 schrieb Stanislav Malyshev:
>>> we are running error_reporting E_ALL for 17 years now and don't
>>> distinct between notice / warning / error, it has to be fixed -
>>> period
>> Surely you do. Your code continues to run after warning/notice but =
stops
>> after the error. It's impossible to ignore that. Unless you have an
>> error handler that does exit() after a notice (which I have hard time
>> believing, honestly, but who knows), there is a very major =
distinction.
>=20
> my server would trigger a mail every 15 minutes wioth all warnings and =
notices to enforce fixing the issue

Out of curiosity: What is your fix?

Because we are running into this issue with fuzzers bombarding our =
website with all types of illegal parameters, string containing 0-bytes =
amongst them.

Our solution was to basically throw away all user input containing =
0-bytes (except $_FILES) which feels awkward but was the only way to =
avoid these messages (and in some cases exceptions) consistently.

Concerning the original question:
My personal preference in this specific case is Stas=E2=80=99 way: =
is_file() is a low-level function and should simply return false for =
*anything* which is not a valid, existing filename. Having *everything* =
involving paths warn/throw an exception when 0-bytes are involved is an =
overly broad generalization.

I challenge everybody to show me how changing is_file() to simply return =
false (while keeping more high-level functions like, say, popen throwing =
an exception) leads to a security hole.

In my preferred world the following code would be both safe and =
guaranteed to report =E2=80=9EFile not found=E2=80=9C on any invalid =
input:
	If (is_file($filename))
		do_something($filename);
	else
		message("File not found=E2=80=9C);

I=E2=80=99ll try to put a PR together for FileFunction() because I think =
those functions should all handle 0-bytes like non-existing files.

- Chris