Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118631
Message-ID: <a82a0fce-2a37-8187-b028-52f989557a2e@bastelstu.be>
Date: Wed, 14 Sep 2022 21:33:49 +0200
MIME-Version: 1.0
Content-Language: en-US
To: Jordan LeDoux <jordan.ledoux@gmail.com>,
 Larry Garfield <larry@garfieldtech.com>
Cc: php internals <internals@lists.php.net>
References: <8479bc9a-6ed6-0cf1-c727-123e2b87a8d6@dafert.at>
 <7e250e89-c18e-9e1a-222a-60521dd2babb@nunninger.info>
 <DEC09231-FDEB-4EDC-A8F3-B9F714112480@dafert.at>
 <6aa89b49-fde5-4779-94e4-97b8b856d02e@www.fastmail.com>
 <CAMrTa2EKkDER30fkpinOgKkHMLTH-QgPEZai0u-9VfTon9c_1A@mail.gmail.com>
In-Reply-To: <CAMrTa2EKkDER30fkpinOgKkHMLTH-QgPEZai0u-9VfTon9c_1A@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Error behaviour for max_input_vars
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 9/14/22 20:44, Jordan LeDoux wrote:
> Honestly, another question I'm thinking about at the moment is whether it's
> possible to construct an attack against known script behavior if you also
> are able to determine the ini config at which partial form data would make
> it to the script with the script thinking it has full form data. To be
> clear, I haven't been able to think of one, but I also recognize that I'm
> not nearly as clever at those sorts of things as some attackers are.

Maybe I misunderstood what you are thinking about, but can't you just … 
not send all the fields to achieve exactly the same results as an attacker?

Best regards
Tim Düsterhus