Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:27489 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 71025 invoked by uid 1010); 16 Jan 2007 21:19:55 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 71009 invoked from network); 16 Jan 2007 21:19:55 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 16 Jan 2007 21:19:55 -0000 Authentication-Results: pb1.pair.com smtp.mail=stas@zend.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=stas@zend.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain zend.com designates 212.25.124.162 as permitted sender) X-PHP-List-Original-Sender: stas@zend.com X-Host-Fingerprint: 212.25.124.162 mail.zend.com Linux 2.5 (sometimes 2.4) (4) Received: from [212.25.124.162] ([212.25.124.162:7348] helo=mail.zend.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id D0/FB-05231-A714DA54 for ; Tue, 16 Jan 2007 16:19:55 -0500 Received: (qmail 32624 invoked from network); 16 Jan 2007 21:18:13 -0000 Received: from office.zend.office (HELO ?127.0.0.1?) (192.168.16.109) by internal.zend.office with SMTP; 16 Jan 2007 21:18:13 -0000 Message-ID: <45AD416E.4020502@zend.com> Date: Tue, 16 Jan 2007 13:19:42 -0800 Organization: Zend Technologies User-Agent: Thunderbird 2.0b1 (Windows/20061206) MIME-Version: 1.0 To: Greg Beaver CC: Stefan Esser , Marcus Boerger , "internals@lists.php.net" References: <45A8FC49.7050909@hardened-php.net> <45A90809.3050008@lerdorf.com> <45A91002.8020607@hardened-php.net> <526994769.20070113181330@marcus-boerger.de> <45AA116F.7020109@hardened-php.net> <45AA961D.4090401@php.net> In-Reply-To: <45AA961D.4090401@php.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] Comments on PHP security From: stas@zend.com (Stanislav Malyshev) > In my opinion, it would be a pity to lose the design benefits of stream > wrappers in the effort to gain more security when security can be gained > without losing the benefits. I think it would be good to allow > disabling all urls as Stefan suggested, but if there is a way to > restrict to truly local stream wrappers, I would need to be educated as > to how this is less secure than outright disabling urls. The problem is, for user streams you can't be sure they are truly local - user stream can do anything, including accessing any URLs, without the streams layer having any say in that. They only way to ensure that user stream is local is for the stream wrapper author to write it local, which we can't control. -- Stanislav Malyshev, Zend Products Engineer stas@zend.com http://www.zend.com/