Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125096
Feedback-ID: ifab94697:Fastmail
Precedence: bulk
MIME-Version: 1.0
Date: Thu, 22 Aug 2024 10:09:52 +0200
To: "John Coggeshall" <john@coggeshall.org>,
 "Ilija Tovilo" <tovilo.ilija@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <2f6fe011-0b07-47ed-8b24-f7eb216317b2@app.fastmail.com>
In-Reply-To: <D397BAC6-7E88-4B0C-A06D-84CAFB5454C9@getmailspring.com>
References: 
 <CAPyj-LB+7AjEXuG4YYX6HhuzxhS-chM7bz8Nwa5cM5TA1HYaRA@mail.gmail.com>
 <D397BAC6-7E88-4B0C-A06D-84CAFB5454C9@getmailspring.com>
Subject: Re: [PHP-DEV] [Concept] Flip relative function lookup order (global, then
 local)
Content-Type: multipart/alternative;
 boundary=997bd7927d1d495598fa6efc08985e2f
From: rob@bottled.codes ("Rob Landers")

--997bd7927d1d495598fa6efc08985e2f
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On Wed, Aug 21, 2024, at 20:32, John Coggeshall wrote:
>=20
>=20
> On Aug 21 2024, at 2:10 pm, Ilija Tovilo <tovilo.ilija@gmail.com> wrot=
e:
>>=20
>> Including a malicious composer package already allows for arbitrary
>> code execution, do you really need more than that?
>=20
> Of course. We've seen many examples in the wild of 3rd party libraries=
 getting hijacked to inject malicious code (e.g. the whole `xz`  attack)=
. This behavior in PHP is not obvious, and provides a way to covertly ta=
rget and hijack specific highly sensitive functions without an obvious w=
ay to detect it -- while otherwise behaving exactly as a developer would=
 expect.
>=20
> Why possibly would we want to make it easier to perform such an attack=
, which as Illija pointed out is actually making PHP slower, in the name=
 of backward compatibility? Defense in depth is a cornerstone of applica=
tion security.
>=20
> John

If you have the ability to inject arbitrary code, you've already lost. I=
t doesn't matter whether they use this feature, or just register a shutd=
own function, autoloader, replace classes/functions/methods entirely, or=
 whatever. Should we remove those features as well?

=E2=80=94 Rob
--997bd7927d1d495598fa6efc08985e2f
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title><style type=3D"text/css">p.Mso=
Normal,p.MsoNoSpacing{margin:0}</style></head><body><div>On Wed, Aug 21,=
 2024, at 20:32, John Coggeshall wrote:<br></div><blockquote type=3D"cit=
e" id=3D"qt" style=3D""><div><br></div><div><br></div><div class=3D"qt-g=
mail_quote_attribution">On Aug 21 2024, at 2:10 pm, Ilija Tovilo &lt;tov=
ilo.ilija@gmail.com&gt; wrote:<br></div><blockquote><div><div><br></div>=
<div>Including a malicious composer package already allows for arbitrary=
<br></div><div>code execution, do you really need more than that?<br></d=
iv></div></blockquote><div><div><br></div><div>Of course. We've seen man=
y examples in the wild of 3rd party libraries getting hijacked to inject=
 malicious code (e.g. the whole <code>xz</code>&nbsp; attack). This beha=
vior in PHP is not obvious, and provides a way to covertly target and hi=
jack specific highly sensitive functions without an obvious way to detec=
t it -- while otherwise behaving exactly as a developer would expect.<br=
></div><div><br></div><div>Why possibly would we want to make it easier =
to perform such an attack, which as Illija pointed out is actually makin=
g PHP slower, in the name of backward compatibility? Defense in depth is=
 a cornerstone of application security.<br></div><div><br></div><div>Joh=
n<br></div></div></blockquote><div><br></div><div>If you have the abilit=
y to inject arbitrary code, you've already lost. It doesn't matter wheth=
er they use this feature, or just register a shutdown function, autoload=
er, replace classes/functions/methods entirely, or whatever. Should we r=
emove those features as well?</div><div><br></div><div id=3D"sig12122915=
2">=E2=80=94 Rob<br></div></body></html>
--997bd7927d1d495598fa6efc08985e2f--