Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:131034
Precedence: list
MIME-Version: 1.0
References: <DD0DF2CC-1F18-A844-B7B8-B00FA2679A47@hxcore.ol>
 <9E95EA03-B86A-D248-A980-B1E838F94C13@hxcore.ol> <20260527131921.086BB1A00BD@lists.php.net>
 <8AE9A269-2E40-42F0-A0F8-C6690B2935FE@gmail.com> <20260528023149.C97961A00BD@lists.php.net>
 <76D39851-7DAC-4F56-9615-B98B0A918770@gmail.com> <20260528043224.2CDD51A00BD@lists.php.net>
 <690e2bc4-d6c9-488b-bbd7-0010437f6c15@gmail.com> <878E83EF-DBA2-429A-A17B-55238600E834@gmail.com>
In-Reply-To: <878E83EF-DBA2-429A-A17B-55238600E834@gmail.com>
Date: Thu, 28 May 2026 12:10:22 +0300
Message-ID: <CAPUh_1Y4HMigpyE4vCCP488ZQhu9UC2GKKiMjCrt3Mw2z4wk5g@mail.gmail.com>
Subject: Re: [PHP-DEV] [Pre-RFC] Pure-code source files via .phpc extension
To: Hendrik Mennen <hmennen90@gmail.com>
Cc: php internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000c8048a0652dd19a4"
From: go.al.ni@gmail.com

--000000000000c8048a0652dd19a4
Content-Type: text/plain; charset="UTF-8"

I see a security concern in introducing a new file extension.

It's common to configure a web server to pass locations that end with .php
to a PHP interpreter.

Nginx example:

```
location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}
```

Apache2 example:

```
<FilesMatch \.php$>
    SetHandler application/x-httpd-php
</FilesMatch>
```

With a new file extension, users would be forced to change their configs,
or a direct request to .phpX file would expose its source code.

This will come as a surprise to users who don't know about the pure syntax
yet include libraries that use it.

--000000000000c8048a0652dd19a4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div dir=3D"auto"><div dir=3D"auto">I see a security conc=
ern in introducing a new file extension.</div><div dir=3D"auto"><br></div><=
div dir=3D"auto">It&#39;s common to configure a web server to pass location=
s that end with .php to a PHP interpreter.</div><div dir=3D"auto"><br></div=
><div dir=3D"auto">Nginx example:</div><div dir=3D"auto"><br></div><div dir=
=3D"auto">```</div><div dir=3D"auto">location ~ \.php$ {</div><div dir=3D"a=
uto">=C2=A0 =C2=A0 include snippets/fastcgi-php.conf;</div><div dir=3D"auto=
">=C2=A0 =C2=A0 fastcgi_pass unix:/run/php/php8.2-fpm.sock;</div><div dir=
=3D"auto">}</div><div dir=3D"auto">```</div><div dir=3D"auto"><br></div><di=
v dir=3D"auto">Apache2 example:</div><div dir=3D"auto"><br></div><div dir=
=3D"auto">```</div><div dir=3D"auto">&lt;FilesMatch \.php$&gt;</div><div di=
r=3D"auto">=C2=A0 =C2=A0 SetHandler application/x-httpd-php</div><div dir=
=3D"auto">&lt;/FilesMatch&gt;</div><div dir=3D"auto">```</div><div dir=3D"a=
uto"><br></div><div dir=3D"auto">With a new file extension, users would be =
forced to change their configs, or a direct request to .phpX file would exp=
ose its source code.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Thi=
s will come as a surprise to users who don&#39;t know about the pure syntax=
 yet include libraries that use it.</div></div></div>

--000000000000c8048a0652dd19a4--