Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:16983
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=dog; d=crynwr.com;
	b=lX3TZgBRWtCQAsx3T0gqyNfJSmQEUi8JQlr+Zv5ecVPthrBjHopSWnvRFKrAvdZK  ;
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17090.9316.148303.68882@desk.crynwr.com>
Date: Wed, 29 Jun 2005 00:32:36 -0400
To: internals@lists.php.net
In-Reply-To: <42C1FF2A.4000006@fission.org.uk>
References: <42BDDC82.6020208@ohgaki.net>
	<17088.52397.92440.326561@desk.crynwr.com>
	<42C0CF76.6090203@lerdorf.com>
	<42C0F4DA.4000605@php.net>
	<17089.18702.450236.614561@desk.crynwr.com>
	<1119998580.13690.109.camel@localhost>
	<17089.63833.772427.529013@desk.crynwr.com>
	<42C1FF2A.4000006@fission.org.uk>
Subject: Re: [PHP-DEV] allow_url_fopen should be INI_ALL
From: nelson@crynwr.com (Russell Nelson)

Gareth Ardron writes:
 > To me, it's obvious that include includes a file - I see no obvious 
 > determination that that file is either local or remote in the "include" 
 > statement.

Can you name some other languages in which 'include' has such
incredibly sharp edges?  C? Python? Perl? BASH? Sed? Awk?  Pascal?
BASIC?  Is there *any* precedent for a language in which 'include'
will fetch hostile code from a remote server and execute it?  If
you're going to argue that experienced programmers will understand
that 'include' will fetch code, you should explain how their
experience helps them.

 > Also, I think it's silly to make include into two functions as you 
 > suggest given that the ability to include a remote file depends on the 
 > fopen wrapper being enabled. If we were to follow this line of logic, we 
 > would have two functions for every current one function which can use 
 > the fopen wrappers.

That's not my line of logic, so following it takes you off the map.

 > I think the documentation quite clearly states that /all/ functions that 
 > deal with files may deal with remote files if the fopen wrappers are 
 > enabled

Why did both of my users miss that documentation?  The facts seem to
be in opposition to your assertion that "the documentation quite
clearly states".

 > However, as I mention above, every single function that can use 
 > fopen wrappers can be exploited in this way.

Not true.  You would need to have *another* security flaw (a bug in
jpg or xml parsing) for hostile jpg or xml content to gain privileges.

 > It's unfortunate, but there's a lot of muppets out there who think
 > they can code

Now you're blaming the victim.

-- 
--My blog is at     blog.russnelson.com         | If you want to find
Crynwr sells support for free software  | PGPok | injustice in economic
521 Pleasant Valley Rd. | +1 315-323-1241       | affairs, look for the
Potsdam, NY 13676-3213  |                       | hand of a legislator.