Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118635
Date: Wed, 14 Sep 2022 21:58:54 +0200
To: internals@lists.php.net
User-Agent: K-9 Mail for Android
In-Reply-To: <9e222608-b142-0b54-5efe-812daeb8780c@bastelstu.be>
References: <8479bc9a-6ed6-0cf1-c727-123e2b87a8d6@dafert.at> <9e222608-b142-0b54-5efe-812daeb8780c@bastelstu.be>
Message-ID: <7B9B123B-47D9-4D7E-B6EF-FD297D3A71CB@dafert.at>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Error behaviour for max_input_vars
From: mel@dafert.at (Mel Dafert)

On 14 September 2022 21:39:36 CEST, "Tim D=C3=BCsterhus" <tim@bastelstu=2Eb=
e> wrote:
>Hi
>
>On 9/13/22 19:58, Mel Dafert wrote:
>> - Deciding that `max_input_vars` is not relevant anymore and should be
>> handled by the likes of Apache and NGINX, thus changing the default to
>> `0` and removing the setting
>>   =C2=A0=C2=A0=C2=A0 over a deprecation period=2E
>
>This would be my preferred option, but my understanding is that the limit=
 still is relevant to protect against attacks on the hash table implementat=
ion=2E The web server can't really protect against this type of attack, bec=
ause the payload required to execute the attack is fairly small=2E Protecti=
ng against the attack without some arbitrary cut-off limit would require ma=
king the hash algorithm used for the superglobals dependent on a randomly g=
enerated per-request seed value=2E I can't comment on how easy or hard that=
 would be to change, but I believe that this should be the ultimate goal he=
re=2E It's also what other programming languages do=2E
>
>Best regards
>Tim D=C3=BCsterhus

Thank you, this makes a lot of sense to me=2E
I assume that this rules out that option, at least for now, unless someone=
 makes the relevant changes to the hashing=2E
But this also means that aborting the request would be just as effective a=
t protecting such an attack as truncating=2E

Would aborting instead of truncating introduce any new attack surface?
The only thing I could think of would be a DoS vector, but I believe there=
 are a lot of ways you can get a server to instantly abort your request=2E=
=2E=2E

Regards,
Mel