Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27439
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain hardened-php.net from 81.169.146.190 cause and error)
Date: Sun, 14 Jan 2007 12:18:04 +0100 (MET)
Message-ID: <45AA116F.7020109@hardened-php.net>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Stanislav Malyshev <stas@zend.com>
CC: Marcus Boerger <helly@php.net>,  "internals@lists.php.net"
 <internals@lists.php.net>
References: <F1076B95-2D05-4690-AE84-21FC0552F17A@ch2o.info>
 <45A8FC49.7050909@hardened-php.net> <45A90809.3050008@lerdorf.com>
 <45A91002.8020607@hardened-php.net>
 <526994769.20070113181330@marcus-boerger.de>
 <Pine.LNX.4.64.0701141301180.32133@mail.zend.com>
In-Reply-To: <Pine.LNX.4.64.0701141301180.32133@mail.zend.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Comments on PHP security
From: sesser@hardened-php.net (Stefan Esser)

Stanislav,

you obviously did not get the point...

It is not about including URL stream wrappers that youself provide.

It is about URL Include vulnerabilities in the application that allow
remote attackers to issue attacks against Userstreams of the application.

I would not be suprised to see some Wrapper Userstream that actually
allows specifying a remote URL (something like php://filter just as
userstream).
And If I am not completely mistaken here unlike php://filter a
userstream will not give the THIS_IS_AN_INCLUDE_FLAG down to a stream
itself opens.

PS: Don't tell me that userstreams are not available at the time of the
include...
I have seen enough stuff like

include "base.lib.php";
...
include $templatepath."/header.php";
...
include $templatepath."/footer.php";


Stefan Esser