Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120811
To: "internals@lists.php.net" <internals@lists.php.net>
Thread-Topic: Security implications of parsing env variables in .ini
Thread-Index: AQHZtc7di4ViQnxuz0S5ICqHTzlWrw==
Date: Thu, 13 Jul 2023 21:25:34 +0000
Message-ID:
 <PH8PR10MB63375994E22A3A9321C01C60BF37A@PH8PR10MB6337.namprd10.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
msip_labels:
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=shymko.net;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: PH8PR10MB6337:EE_|PH0PR10MB5871:EE_
x-ms-office365-filtering-correlation-id: 8b2fa755-48ca-4b26-dd7f-08db83e7b1b5
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 RY/WMpox2dyR4qWvrbayuuHdRx4jQg/FldpSYCekVDppqoUdNF1KbD70IrKpX2DA3HZLS4IsuZnrqgmhtETL7TTIwH7Vs0PnMfi9bat56ndbqZBF1IjYAH0M+1bgngY+i8YumJAgNXznBiwo5uvr1l9GFiE3Mw6t4E7m4r25+hLJSMbW+wTgQfrM0BHOYtOdr1aQl1AX//1gpfE5+SSR9yPmSz17QaHU9ggQbsk3eVFIKgFD+Rexv9/IZQRxfWD0gdwcseuiaEl7DqeTxu3b5CAUGVMXIMF3uINy3vlPCbfwOR/QxxIIK8pgdydbDDMtpVzDMt21ST8ApAym9La/OaDjB01uFW0xAWe1C0WtWGwYvStuUK5pIeDA+iT959ZjOb/biARYHB0d7m7DF9f1iAH9DzWRf42/7zkQh4J538YU42RVS8jESu+GR1Leh5QUqGHfOPZjRQOZfIvGeelrRO3S0gp37QZbDXYPehmT4nFsqheDWb/RrCli9A1K3GoZ0yXaI8TbI8ka/VCWAB+avehpSjycwlSSv+F1cak45cOJQmH89104CF4M6chJ7hT2bgkJOEPU4pnIKgM6RG1ZSVSlJ5qaAz7rriQAvHoQxWKZRQ/sJM6oTGTMJ+1KFV5G
x-forefront-antispam-report:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH8PR10MB6337.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(376002)(346002)(39830400003)(366004)(396003)(136003)(451199021)(76116006)(6916009)(66556008)(66946007)(66446008)(66476007)(64756008)(15650500001)(91956017)(33656002)(2906002)(55016003)(316002)(966005)(9686003)(83380400001)(41300700001)(5660300002)(38100700002)(6506007)(71200400001)(8936002)(86362001)(122000001)(478600001)(38070700005)(7696005)(19627405001)(8676002)(186003)(52536014)(166002)(142923001);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?iso-8859-1?Q?Zkn+Cd7pZk+WhZFVoh8YtlKb1+7Z1Vh//FBuOmMPDRl9Y1kAvMw82z6TGm?=
 =?iso-8859-1?Q?T396wJlOiS1bQuKcA494P8QX3oULCrkJcoKjp80pKVCWY7V+UUcYUXxyUV?=
 =?iso-8859-1?Q?3k6Wyp7ofx3osLoanvnbPvw6WefYLw2ZnmHCuubbmXjqD1A2vzsZTl/wqn?=
 =?iso-8859-1?Q?aIGtFE/10iPyIuKiW+uPHh1RTzh1uTA14lp7N2W7/rmfFGgSJwPaUdPJc0?=
 =?iso-8859-1?Q?GH0AY/JbxGYPgem39TBOdh6jKip+HSj+5pqLr6AFdJav0WNU+gUmnma3Tt?=
 =?iso-8859-1?Q?XyWudAUBSZXy/uJx87CH0Q/zV+maua6AzTbO5TXTNGhGCmj7zzgaoUz1sy?=
 =?iso-8859-1?Q?Cv/ueldt19EErNDcmah5umuQ1nyTlwmyAwWx7hYxVKvm8g7G9yE9HTRSvG?=
 =?iso-8859-1?Q?TXrjmWMvR+o6ZYb3xSYQhc3jBvTetnFAFQK7ZdFmfTJwRMZ3v+XNkm8dWq?=
 =?iso-8859-1?Q?31s8J7YjBxJkSajCeP3lSnBX0gGdUzCWtPZ4vMvaPHswBiiiXIJlaFQXnI?=
 =?iso-8859-1?Q?smWy6O5o1fFU4p2+NjhoUCF1MpiuQLLQwD/u14kzvNnvt2E1qJqtqbdVwY?=
 =?iso-8859-1?Q?HBI42zkOupQue0IaDad6pEhWh9zsea+fgQfnoB+lUrk7OlfsvI7HI3Rkww?=
 =?iso-8859-1?Q?biBJdyfhxKtkfOQ1yJ1AHV8eTOtxENm9spDy8tnfFLhUNyHDvF2XpRrfj5?=
 =?iso-8859-1?Q?GBa7qwY1v1eCtDsucoJKnKQ71iUob5G0QhcJbhAsRN2J/KdNsy5BAz+cLn?=
 =?iso-8859-1?Q?GxhNA67C1Oh4VnDDBtrbcdUr6NcP0RVxCo08hazprrFGsnBi67ySpYZ20P?=
 =?iso-8859-1?Q?p+ueWt8Yys8BYcouQBdFMXV1SZkyoel3B/Lhnmo/ayRMVMjcAF5ZJTocny?=
 =?iso-8859-1?Q?E5H0RarBhBgDmoBGbokLJo8v4UiGeh2Ic0oddX7vNWw4bDCdjMPCipLXIp?=
 =?iso-8859-1?Q?4T7igTBPlBTfXo4QWC4Big5gwhZbagV2EtmkzmSWlrOKJ0/K16Brzo2Nu7?=
 =?iso-8859-1?Q?+y3K02iQjzxr8b0vyG4LKrR1R9pRlRxFXXMHNovw8oUOX7Ffnf8Da8HQZi?=
 =?iso-8859-1?Q?D+zkPo9NZqzSyXGowRx5JKLQuMwNSWX/o+CuEzLqQiTHb/aIZ2YY7HZehp?=
 =?iso-8859-1?Q?5iWtTToIIfoUB6YcLKlxAJUwehoFXrod575eB1GgSJttO8tz5wFMskd3e5?=
 =?iso-8859-1?Q?2cYS5W2BmNcW3LVZlwyUpS+N77SJwU9HMjF1oS2Ig6+rzChHc9mnroxJU+?=
 =?iso-8859-1?Q?QCw1LYo4+jkHpAmDu4O1amMGWTZYX5zNuV2Cu4qr4IA4G/iwAX7BaEnUIX?=
 =?iso-8859-1?Q?jD8zNqHOGUS+o98v+w36/ioX4oZj8uQHPUB29evQIuZu0MCAtV3Vh76vSM?=
 =?iso-8859-1?Q?fnLO/1h9mByrxTdke1PdJ9yT/q8YBXG+MzDN1Ky01ZmWZIIvMt9DTCevyo?=
 =?iso-8859-1?Q?9kACYVhplbaFE9+t/W/J7lKSPROAtyALxfDye8Ko8Wnb6tQvkmnrQECDg4?=
 =?iso-8859-1?Q?3/wv/Ux7Iv+r+22utdn+MGLUFUdoAeJcGbfub9rUep+iD2HdMdJ8qVXZOh?=
 =?iso-8859-1?Q?FhpjW6U7yBF4HT9Zj+MlQQ4to1uW4IJkC7u3RifKZfMhJSIfzvFMTlkgMA?=
 =?iso-8859-1?Q?8ZhLzlKPkv2eGLWh2p1TSZvIUHutl1tVaYNibIQgoUjSVdaw7fnn7YaIWd?=
 =?iso-8859-1?Q?ZwFVzed8pXJBn6DwMrI=3D?=
Content-Type: multipart/alternative;
	boundary="_000_PH8PR10MB63375994E22A3A9321C01C60BF37APH8PR10MB6337namp_"
MIME-Version: 1.0
X-OriginatorOrg: shymko.net
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH8PR10MB6337.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8b2fa755-48ca-4b26-dd7f-08db83e7b1b5
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2023 21:25:34.4884
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d7878c48-41c7-48dd-bd7e-899af7355b7e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: p9wlPBmkNI/ElxTN3/mUiszwr6SWhEdIYdZWqhzZhf8Nq9/nO4NRe2vkp73g1AwlOPia2wAZuLQB36SdzpqQKg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5871
Subject: Security implications of parsing env variables in .ini
From: sergey@shymko.net (Sergii Shymko)

--_000_PH8PR10MB63375994E22A3A9321C01C60BF37APH8PR10MB6337namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi internals team,

The discussion of extending the .ini env variable parsing capabilities with=
 ability to specify defaults it occurred to me that the while feature of en=
v variables may have undesirable security implications.

For instance, functions parse_ini_string() and parse_ini_file() do support =
the aforementioned env variables syntax, because the underlying code is reu=
sed. That means that these functions can potentially be exploited to read s=
ensitive information!

For example:
AWS_SECRET_ACCESS_KEY=3DamazonWebServicesSecretAccessKeyExample1 php -r 'va=
r_export(parse_ini_string("secret=3D\${AWS_SECRET_ACCESS_KEY}"));'
array (
  'secret' =3D> 'amazonWebServicesSecretAccessKeyExample1',
)

This only affects INI_SCANNER_NORMAL (the default). Should the mode argumen=
t be changed to disallow the env parsing by default? Perhaps another consta=
nt can be introduced to activate it, for example:
INI_SCANNER_NORMAL | INI_SCANNER_PARSE_ENV

This would be a BC breaking behavior but it's doubtful many people expected=
 the env variable parsing syntax to extend to parse_ini_file/string() funct=
ions in the first place.

P.S.
My email client doesn't properly support the top-reply and/or quoting requi=
rements of the mailing list. That's what made me disengage from the mailing=
 list to not annoy anybody with butchered reply threads until I find time t=
o migrate to another email client.

Here's a related tweet of mine:
https://twitter.com/SergiiShymko/status/1679598903925129222?s=3D20

Regards,
Sergii Shymko

--_000_PH8PR10MB63375994E22A3A9321C01C60BF37APH8PR10MB6337namp_--