Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:128200
Precedence: bulk
MIME-Version: 1.0
References: <b868eb26-8598-48ac-a75a-870bc22db93a@tu-braunschweig.de>
In-Reply-To: <b868eb26-8598-48ac-a75a-870bc22db93a@tu-braunschweig.de>
Date: Wed, 23 Jul 2025 21:01:14 +0200
Message-ID: <CAGBsUrdGw35y7i58=-kZxk3c42Fa1v8DWZLc2BCz9yaYhOWQqA@mail.gmail.com>
Subject: Re: [PHP-DEV] Study on unsafe extract() usage
To: Jannik Hartung <jannik.hartung@tu-braunschweig.de>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000018e27063a9d56ea"
From: tekiela246@gmail.com (Kamil Tekiela)

--000000000000018e27063a9d56ea
Content-Type: text/plain; charset="UTF-8"

>
> This would prevent most of the

vulnerabilities found in the dataset and we cannot think of a valid use

case for allowing this behavior


But not all. This function is dangerous on its own. Attack vectors are 99%
through superglobals but could come from other sources too. However, this
function is handy when used correctly.

I agree with everything stated in the email. Using extract() on
superglobals is definitely an incorrect usage and should be forbidden. If
it's something that we can do then we should do it as soon as possible even
if it means breaking some poorly written code.

Empty prefix should be a bug and as such I recommend adding an error for
this in PHP 8.5 without deprecation or RFC.

One more thing that would improve security is to change the default flag to
EXTR_SKIP. It would be a major BC though so we could probably only do it in
PHP 9.

--000000000000018e27063a9d56ea
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div><div class=3D"gmail_quote gmail_quote_container"><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #=
ccc solid;padding-left:1ex">This would prevent most of the
</blockquote><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;b=
order-left:1px #ccc solid;padding-left:1ex">vulnerabilities found in the da=
taset and we cannot think of a valid use</blockquote><blockquote class=3D"g=
mail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-l=
eft:1ex">case for allowing this behavior</blockquote></div></div><div dir=
=3D"auto"><br></div><div dir=3D"auto">But not all. This function is dangero=
us on its own. Attack vectors are 99% through superglobals but could come f=
rom other sources too. However, this function is handy when used correctly.=
=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">I agree with ever=
ything stated in the email. Using extract() on superglobals is definitely a=
n incorrect usage and should be forbidden. If it&#39;s something that we ca=
n do then we should do it as soon as possible even if it means breaking som=
e poorly written code.=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"a=
uto">Empty prefix should be a bug and as such I recommend adding an error f=
or this in PHP 8.5 without deprecation or RFC.=C2=A0</div><div dir=3D"auto"=
><br></div><div dir=3D"auto">One more thing that would improve security is =
to change the default flag to EXTR_SKIP. It would be a major BC though so w=
e could probably only do it in PHP 9.=C2=A0</div><div dir=3D"auto"></div></=
div>

--000000000000018e27063a9d56ea--