Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:26212
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 204.11.219.139 cause and error)
Message-ID: <453D4FC1.5010104@lerdorf.com>
Date: Mon, 23 Oct 2006 16:26:57 -0700
User-Agent: Thunderbird 1.5.0.7 (Macintosh/20060909)
MIME-Version: 1.0
To: Peter Brodersen <penguin@php.net>
CC: PHP internals <internals@lists.php.net>
References: <453C81F8.7080606@hardened-php.net> <AC834693-5FA5-43F1-89DB-C9E3C4836CCA@prohost.org> <453CFE17.5020809@lerdorf.com> <9hiqj2dupeap8a98pfisf637joqhobd8jq@4ax.com>
In-Reply-To: <9hiqj2dupeap8a98pfisf637joqhobd8jq@4ax.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP 5.2.0 release with "broken" input filters
From: rasmus@lerdorf.com (Rasmus Lerdorf)

Peter Brodersen wrote:
> On Mon, 23 Oct 2006 10:38:31 -0700, in php.internals
> rasmus@lerdorf.com (Rasmus Lerdorf) wrote:
> 
>> I had left out SERVER filtering in the initial version for much the same 
>> reasoning, but it turns out that a good chunk of holes were due to the 
>> fact that people used $_SERVER['REQUEST_URI'] unfiltered.  Trying to 
>> teach people which SERVER vars are safe and which aren't isn't a fun 
>> task and the whole point of the filter extension is to take away the 
>> guessing game.
> 
> More well-known, the same goes for the HTTP headers populated in
> _SERVER as well, even though some might be less obvious than other.
> 
> HTTP_HOST could be tainted as well in some cases where a DNS entry and
> ServerAlias of *.example.com exists.

Actually, by using the Flash hack, you don't need wildcard DNS to 
exploit that one.  As anybody who has seen my ranting lately can attest 
to, name-based virtual hosting is completely broken until we get 
everyone onto Flash9.

-Rasmus