Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121608
MIME-Version: 1.0
References: <CAMGiJ1-hwC18jA51a0NZbUeVR8EMvV65omzw6WsQ9Q1UPJgO=Q@mail.gmail.com>
In-Reply-To: <CAMGiJ1-hwC18jA51a0NZbUeVR8EMvV65omzw6WsQ9Q1UPJgO=Q@mail.gmail.com>
Date: Tue, 7 Nov 2023 15:48:32 +0000
Message-ID: <CAFPFaM+EgjK4m81mvdwzni5gYJ=CUxD-nctp6YuHqemQ9qiGHQ@mail.gmail.com>
To: Thomas Chauchefoin <thomas.chauchefoin@sonarsource.com>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary="000000000000c28d56060991e7e4"
Subject: Re: [PHP-DEV] Set register_argc_argv to Off by default
From: george.banyard@gmail.com ("G. P. B.")

--000000000000c28d56060991e7e4
Content-Type: text/plain; charset="UTF-8"

On Tue, 7 Nov 2023 at 10:33, Thomas Chauchefoin via internals <
internals@lists.php.net> wrote:

> Hey,
>
> I recently opened an issue on GitHub [1] to discuss setting
> register_argc_argv to Off by default for all SAPIs but cli, embed, and
> phpdbg. Ilija Tovilo suggested including this change in 8.4.0.
>
> Even though most downstream distributions already turn it off, that's
> not the case everywhere. For instance,  the official Docker image has
> it on [2]. Outside of performance reasons, this also has a security
> impact because it eases the exploitation of limited LFI bugs [3] and
> CLI tools stored under the web root [4].
>
> -Thomas
>
> [1]: https://github.com/php/php-src/issues/12344
> [2]: https://hub.docker.com/_/php
> [3]: https://www.youtube.com/watch?v=yq2rq50IMSQ
> [4]: https://github.com/advisories/GHSA-jm6m-4632-36hf
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>

This sounds sensible to me.

Best regards,

Gina/George P. Banyard

--000000000000c28d56060991e7e4--