Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27430
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 204.11.219.139 cause and error)
Message-ID: <45A91629.1080404@lerdorf.com>
Date: Sat, 13 Jan 2007 09:26:01 -0800
User-Agent: Thunderbird 1.5.0.9 (Macintosh/20061207)
MIME-Version: 1.0
To: Ilia Alshanetsky <ilia@prohost.org>
CC: Marcus Boerger <helly@php.net>, Stefan Esser <sesser@hardened-php.net>,
        "internals@lists.php.net" <internals@lists.php.net>
References: <F1076B95-2D05-4690-AE84-21FC0552F17A@ch2o.info> <45A8FC49.7050909@hardened-php.net> <45A90809.3050008@lerdorf.com> <45A91002.8020607@hardened-php.net> <526994769.20070113181330@marcus-boerger.de> <C9C07D55-09C8-4E9E-82C6-F8B3FE5F7BFB@prohost.org>
In-Reply-To: <C9C07D55-09C8-4E9E-82C6-F8B3FE5F7BFB@prohost.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Comments on PHP security
From: rasmus@lerdorf.com (Rasmus Lerdorf)

I thought we also decided to default user streams to be marked as
insecure with some mechanism for overriding it.

-Rasmus

Ilia Alshanetsky wrote:
> Marcus,
> 
> You want to use an INI setting to specify which streams are local and
> which are remote? That seems like a recipe for disaster to me, people
> adjusting this setting many not consider some streams that are remote
> etc... leading to security holes. There is really no reason why PHP
> could not effectively use flags internally to identify the difference
> between the two sources of streams. Ultimately it'll always fall to the
> extension writer, same as with open_basedir, which author can choose to
> bypass if they so choose to.
> 
> The main issue here is I think is that is_url flag is new and there are
> many extensions providing remote wrapper that have been written prior to
> its addition and therefor do not have a proper setting in place, which
> may have been added in a hurry to solve a compilation failure.
> 
> On 13-Jan-07, at 12:13 PM, Marcus Boerger wrote:
> 
>> Hello Stefan,
>>
>>   i also think something should be done here. The is_url flag does not
>> really help. What we imho need is an ini setting that allows specifying
>> which stream handlers to allow. And that should not include user streams.
>>
>> best regards
>> marcus
> 
> Ilia Alshanetsky
> 
> 
>