Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57191
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4F048A03.4070408@sugarcrm.com>
References: <CABBJUpc7T2QZm8QiitQ0wZ5RsY=3Jwy_UERSvLT9unNYtJ1mZA@mail.gmail.com>
	<CABBJUpcVkYwU4zN0dG2b+jYkppnY9HR8wm7FV0tnmGt6ky5wQg@mail.gmail.com>
	<CABBJUpeN4iJ6mVUKEEz8qxY25zxTmwg8EigpsmxnZGz5xshMhw@mail.gmail.com>
	<4F048A03.4070408@sugarcrm.com>
Date: Wed, 4 Jan 2012 19:55:02 +0100
Message-ID: <CAH-PCH69gV88qnQ7OHhGHSt70oD7f9Z_HCFD7dfW6SmBR6z2tQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Laruence <laruence@php.net>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=00235429e0b873a1c504b5b85adf
Subject: Re: [PHP-DEV] Re: another fix for max_input_vars.
From: tyra3l@gmail.com (Ferenc Kovacs)

--00235429e0b873a1c504b5b85adf
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 4, 2012 at 6:18 PM, Stas Malyshev <smalyshev@sugarcrm.com>wrote=
:

> Hi!
>
>
>  Hi:
>>    I have updated the patch, make it works in case of sub arrays.
>>
>>   http://pastebin.com/yPTUZuNe
>>
>
> I'm sorry, I'm not sure still I understand - what is this patch fixing?
> I.e. what is the problem with the current PHP that needs this patch?
>
>
the max_input_vars was introduced to fix
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2011-4885

My understanding is that the original patch was too intrusive, from the
comment of Laruence, it seems that throwing an E_ERROR in that phase means
that you can kill the cgi workers if you pass the malicious input, which
has still some DOS potential, this seems to be backed as Dmitry changed the
original patch, to only raise a warning and ignore the vars over the set
limits: http://svn.php.net/viewvc?view=3Drevision&revision=3D321335

From the comments by Laruence it seems that he thinks that we only need to
limit post, as get and cookie has external limits.
I disagree with this, for two reasons:
- we also have post_max_size to limit the length of the Post
Content-Length, so by the same logic, we wouldn't need an additional ini
setting for limiting the number of variables.
- we also have max_input_nesting_level, so having a max_input_vars seems to
be more consistent, than max_post_vars

I would also like to point out, that when we added max_input_nesting_level
we later polished that a little bit:
http://svn.php.net/viewvc/php/php-src/trunk/main/php_variables.c?r1=3D23394=
0&r2=3D236894
http://svn.php.net/viewvc/php/php-src/trunk/main/php_variables.c?r1=3D23689=
8&r2=3D239877

And I guess at least the information disclosure part would be needed here
also ( https://twitter.com/#!/i0n1c/status/152356767601393665 )

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--00235429e0b873a1c504b5b85adf--