Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115019
MIME-Version: 1.0
Date: Tue, 22 Jun 2021 14:25:19 +0300
To: Joe Watkins <krakjoe@gmail.com>
Cc: Claude Pache <claude.pache@gmail.com>, Craig Francis
 <craig@craigfrancis.co.uk>, PHP internals <internals@lists.php.net>
In-Reply-To: <CAOwTYAu2hQaJYM4mJN0DDYmPhP9BHcnrxM1f459wKa-jj1TnDg@mail.gmail.com>
References: <CAFv4g+F-7F7o6va5wCrojKe+Uysx2Ec3H4yV_mUZYEyNm3MkdQ@mail.gmail.com>
 <C2605471-8EC9-4C36-88D4-E98F5C291BCF@gmail.com>
 <CAOwTYAu2hQaJYM4mJN0DDYmPhP9BHcnrxM1f459wKa-jj1TnDg@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.11
Message-ID: <1229f71be88401d9eb55a212f53e3eae@gmail.com>
Content-Type: text/plain; charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] [RFC] is_literal
From: lauri.kentta@gmail.com (=?UTF-8?Q?Lauri_Kentt=C3=A4?=)

On 2021-06-15 10:19, Joe Watkins wrote:
> It's just that existing implementation details - RETURN_CHAR using 
> interned
> strings, and literal constant strings being interned by the compiler - 
> lead
> to a literal string being "re-used".
> 
> This is just a natural consequence of literal strings retaining their
> literalness in the way we want them too, nothing dangerous is going on.

This happens with substr as well, even with user input.
With just one character, the possibilities are rather limited, but still 
I'm sure someone finds a way to turn this into a vulnerability.

Such as:
$c = substr($input, 0, 1); # $c is now literal.
$sql = "SELECT * FROM t WHERE c LIKE '$c%'";

Hopefully this "retaining literalness" does not extend to longer strings 
after any operations.

What about Opcache? A few years back I debugged some interning-related 
bugs which only manifested with Opcache, so I'm just thinking maybe 
there's some way to exploit Opcache to make some string interned under 
special circumstances, and just maybe that string can then be 
accidentally reused in a SQL query. I'm not in the mood to dive into 
Opcache internals to check this, so I hope someone with prior knowledge 
can tell what kind of strings get interned by Opcache. Array keys? 
Object properties?

-- 
Lauri Kenttä