Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125097
Date: Thu, 22 Aug 2024 13:56:30 -0400
To: Rob Landers <rob@bottled.codes>
Cc: Ilija Tovilo <tovilo.ilija@gmail.com>, 
 "=?utf-8?Q?internals=40lists.php.net?=" <internals@lists.php.net>
Message-ID: <5B453EA2-E5E3-4CA2-AEF8-B97DAC8D12D2@getmailspring.com>
In-Reply-To: <2f6fe011-0b07-47ed-8b24-f7eb216317b2@app.fastmail.com>
References: <2f6fe011-0b07-47ed-8b24-f7eb216317b2@app.fastmail.com>
Subject: Re: [PHP-DEV] [Concept] Flip relative function lookup order
 (global, then local)
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="66c77bce_6b8b4567_164e6"
From: john@coggeshall.org (John Coggeshall)

--66c77bce_6b8b4567_164e6
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline



On Aug 22 2024, at 4:09 am, Rob Landers <rob@bottled.codes> wrote:
>
> If you have the ability to inject arbitrary code, you've already lost. It doesn't matter whether they use this feature, or just register a shutdown function, autoloader, replace classes/functions/methods entirely, or whatever. Should we remove those features as well?
I think it's a fallacy to claim "well if they got this far the game is over" when it comes to application security. There are a million ways an attacker could use this feature to covertly gain access to things like passwords before they are encrypted, etc. that would enable lateral movement within an organization that otherwise they might have difficulty achieving even with RCE in a properly locked down system (e.g. PHP doesn't have the ability to write to the filesystem / overwrite existing classes, etc.)
Regarding the subject at hand I've made my case here and we can agree to disagree -- changing the function lookup order is an easy win with security benefits and, according to Ilija, performance benefits. I think it should be seriously considered.
John
--66c77bce_6b8b4567_164e6
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<br><br><div class=3D=22gmail=5Fquote=5Fattribution=22>On Aug 22 2024, at=
 4:09 am, Rob Landers &lt;rob=40bottled.codes&gt; wrote:</div><blockquote=
><br><div>If you have the ability to inject arbitrary code, you've alread=
y lost. It doesn't matter whether they use this feature, or just register=
 a shutdown function, autoloader, replace classes/functions/methods entir=
ely, or whatever. Should we remove those features as well=3F</div></block=
quote><br><div>I think it's a fallacy to claim =22well if they got this f=
ar the game is over=22 when it comes to application security. There are a=
 million ways an attacker could use this feature to covertly gain access =
to things like passwords <em>before</em>&nbsp; they are encrypted, etc. t=
hat would enable lateral movement within an organization that otherwise t=
hey might have difficulty achieving even with RCE in a properly locked do=
wn system (e.g. PHP doesn't have the ability to write to the filesystem /=
 overwrite existing classes, etc.) </div><br><div>Regarding the subject a=
t hand I've made my case here and we can agree to disagree -- changing th=
e function lookup order is an easy win with security benefits and, accord=
ing to Ilija, performance benefits. I think it should be seriously consid=
ered.</div><br><div>John</div>
--66c77bce_6b8b4567_164e6--