Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27427
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain hardened-php.net from 81.169.146.189 cause and error)
Date: Sat, 13 Jan 2007 17:59:45 +0100 (MET)
Message-ID: <45A91002.8020607@hardened-php.net>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Rasmus Lerdorf <rasmus@lerdorf.com>
CC: "internals@lists.php.net" <internals@lists.php.net>
References: <F1076B95-2D05-4690-AE84-21FC0552F17A@ch2o.info>
 <45A8FC49.7050909@hardened-php.net> <45A90809.3050008@lerdorf.com>
In-Reply-To: <45A90809.3050008@lerdorf.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Comments on PHP security
From: sesser@hardened-php.net (Stefan Esser)


> I am not sure I would call it a blacklist.  It is a flag in the streams
> layer that marks stream handlers that could possibly make a network
> connection as such and there are only a finite set of stream handlers.
>   
Unfortunately there is not a finite set of stream handlers. First of all
there are userstreams. An application could register a dangerous
userstream (that is of course not marked as URL) which is then abused by
an include.
Then there are PECL extensions that register streams.

Just pick a random one: Let's take ext/ssh2. This is not just any pecl
extension, but one from a PHP core developer.

SSH is obviously a network protocol. The PHP documentation even states
that SSH streams are forbidden during allow_url_fopen.
However from looking at the code I assume this documentation is wrong,
because I see all is_url flags being set to 0.

Voila, just install pecl/ssh and you are still vulnerable to remote file
includes.

That is the problem with opt-in/aka blacklist methods.

Stefan