Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125092
Precedence: bulk
MIME-Version: 1.0
References: <c0058f34-063c-4610-a3aa-6bc3f328e229@app.fastmail.com> <66592B01-1A40-4FCD-8FEE-8EB8338069D0@getmailspring.com>
In-Reply-To: <66592B01-1A40-4FCD-8FEE-8EB8338069D0@getmailspring.com>
Date: Wed, 21 Aug 2024 20:10:50 +0200
Message-ID: <CAPyj-LB+7AjEXuG4YYX6HhuzxhS-chM7bz8Nwa5cM5TA1HYaRA@mail.gmail.com>
Subject: Re: [PHP-DEV] [Concept] Flip relative function lookup order (global,
 then local)
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: tovilo.ilija@gmail.com (Ilija Tovilo)

Hi John

On Wed, Aug 21, 2024 at 8:02=E2=80=AFPM John Coggeshall <john@coggeshall.or=
g> wrote:
>
> This is an attack vector for every application and I would argue should b=
e a real concern for the vast majority of applications  out there -- any wh=
ich rely on namespace-based frameworks and composer packages from untrustwo=
rthy sources. It's not just Wordpress -- literally every single PHP applica=
tion that uses a publicly available framework and consumes external compose=
r packages should be FQing their internal function calls. The natural behav=
ior of the language shouldn't be the insecure way of doing things for the s=
ake of maintaining BC compatibility with existing, insecure, code.

Including a malicious composer package already allows for arbitrary
code execution, do you really need more than that?

Ilija