Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:17030
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=dog; d=crynwr.com;
	b=MHR5IgsvPydCM2esxuSlYWZo7ebCURfqBYyW0hGgJ9krMzft3cjNA7bmj50mLKk1  ;
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17091.32753.839430.671829@desk.crynwr.com>
Date: Thu, 30 Jun 2005 01:15:29 -0400
To: internals@lists.php.net
Subject: Bringing the 'include' discussion to an end
From: nelson@crynwr.com (Russell Nelson)

Okay, I'm leaving for vacation in 7 hours.  I'd like to bring the
'include' discussion to an end.  There have been a lot of weak points
made, e.g. "Yeah, it's a problem; that's why we documented it".
Rather than re-dismiss them, I'll ignore them in favor of addressing
the strongest ones.

  o This problem is decreasing in frequency according to vulnerability
    reports, so there is no urgency about fixing it.

People aren't going to report vulnerabilities when they are
persistently told "That's not a bug; that's a feature!"
Vulnerability reports are self-selected and thus are not a good
sample for even the most rudimentary statistical analysis like "the
rate is decreasing."

  o If you trust user data you are eventually going to get screwed; if
  not by 'include' then by something else.

It's not obvious that 'include' can be convinced to execute remote
code.

  o We're not fixing it.

This is simultaneously a weak point and a very strong one.
Obviously the maintainer of a codebase can publish code with any
number of vulnerabilities in it and nobody can do anything about it
other than to stop using the code.  On the other hand, the code is
still vulnerable, so not fixing it is no solution.

  o We *are* fixing it, but just not your way.

Depending on the exact nature of the fix, this may be a reasonable
response.  The fix needs to address the problem that 'include' has
hidden sharp edges.  If it merely offers a way to optionally cover the
sharp edge, then it won't fix the problem.  Other optional fixes
(e.g. allow_url_fopen==false) haven't yet fixed the problem.  Why
should this one fix it?

-- 
--My blog is at     blog.russnelson.com         | If you want to find
Crynwr sells support for free software  | PGPok | injustice in economic
521 Pleasant Valley Rd. | +1 315-323-1241       | affairs, look for the
Potsdam, NY 13676-3213  |                       | hand of a legislator.