Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27426
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 204.11.219.139 cause and error)
Message-ID: <45A90809.3050008@lerdorf.com>
Date: Sat, 13 Jan 2007 08:25:45 -0800
User-Agent: Thunderbird 1.5.0.9 (Macintosh/20061207)
MIME-Version: 1.0
To: Stefan Esser <sesser@hardened-php.net>
CC: "internals@lists.php.net" <internals@lists.php.net>
References: <F1076B95-2D05-4690-AE84-21FC0552F17A@ch2o.info> <45A8FC49.7050909@hardened-php.net>
In-Reply-To: <45A8FC49.7050909@hardened-php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Comments on PHP security
From: rasmus@lerdorf.com (Rasmus Lerdorf)

Stefan Esser wrote:
> It is very good that bugs in PHP Applications are bad for PHP's image.
> The majority of servers get hacked because of Remote URL Includes (and
> not by XSS/SQL Injection). The existance of Remote URL Includes is fully
> to blame on the PHP engine and is UNIQUE. After years the feature is
> still not kicked out of PHP. In PHP 5.2.1 there will be a configuration
> option that activates an (incomplete) blacklist. Everyone should know by
> now that blacklists are BAD.

I am not sure I would call it a blacklist.  It is a flag in the streams
layer that marks stream handlers that could possibly make a network
connection as such and there are only a finite set of stream handlers.
Assuming we have marked the right streams, which I think we have at this
point, the only way to trick it would be to bounce through some sort of
file system network mechanism like auto-mounted file systems or perhaps
some \\Server\path\foo.php thing on Windows, but at that level I think
it is up to the local sysadmin to make sure the PHP scripts can't get to
something they shouldn't.

-Rasmus