Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59456
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain punkave.com designates 209.85.216.170 as permitted sender)
References: <CAORXhGLk8=bJ2TEo0OCzQCacjtGG=ZWYNuXf8Uu8oMNEm2WQ1A@mail.gmail.com> <CAGa2bXYP0kNA5PyvmdjoHZO91t8AojG9FjUe4nbCHhGjn2=MPg@mail.gmail.com> <4F80C739.2060404@gmail.com> <CAGa2bXZSgV3bRPGMt6Esw16v3ErVMLVQy1fb8cZxdc=OokpXKg@mail.gmail.com> <4F817DE1.3020608@gmail.com>
In-Reply-To: <4F817DE1.3020608@gmail.com>
Mime-Version: 1.0 (1.0)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8
Message-ID: <2AD65A37-E1D3-4663-B580-D18C78118387@punkave.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>,
 PHP Developers Mailing List <internals@lists.php.net>
Date: Sun, 8 Apr 2012 08:31:54 -0400
To: =?utf-8?Q?=C3=81ngel_Gonz=C3=A1lez?= <keisial@gmail.com>
Subject: Re: [PHP-DEV] PHP class files without <?php at the top
From: tom@punkave.com (Tom Boutell)

This is an attempt to protect people who have written inherently insecure co=
de anyway. One should never do a dynamic require to any untrusted location, i=
f ever at all, yes?=20

Sent from my iPhone

On Apr 8, 2012, at 8:00 AM, =C3=81ngel Gonz=C3=A1lez <keisial@gmail.com> wro=
te:

> 2012/4/8, Yasuo Ohgaki:
>> 2012/4/8 =C3=81ngel Gonz=C3=A1lez <keisial@gmail.com>:
>>> How does it help security?
>>> If any, requiring '<?php' before executable code makes easier to filter
>>> out malicious files on apps with uploads in case there's a local
>>> inclusion vulnerability somewhere.
>>>=20
>> Attackers may inject PHP script almost anything/anywhere since
>> PHP code may be embed anywhere in a file.
>>=20
>> For example, malicious PHP script may be in GIF something like
>>=20
>> gif89a ...any data.. <?php exec('rm -rf /') ?>
>>=20
>> and all attacker have to do is include/require the data somehow.
>> Attacker cannot do that this for other languages, since they are
>> not a embedded language. I know case that attackers may inject
>> malicious perl/ruby script in data files, but PHP is too easy
>> compare to these languages.
>>=20
>> Regards,
>>=20
>> --
>> Yasuo Ohgaki
> Yes, but if I properly check that there's no '<?php' in the uploaded files=

> (as you should verify everything you allow users to upload), it can't be
> exploited.
> OTOH if the vulnerable include is not an include but an include_code,
> they could
> use a file which was
>> exec("rm -rf"); // Example of what not to do
> And was happily uploaded as "plain text".
>=20
>=20
>=20
>=20
> --=20
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>=20