Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59470
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <4F817DE1.3020608@gmail.com>
References: <CAORXhGLk8=bJ2TEo0OCzQCacjtGG=ZWYNuXf8Uu8oMNEm2WQ1A@mail.gmail.com>
 <CAGa2bXYP0kNA5PyvmdjoHZO91t8AojG9FjUe4nbCHhGjn2=MPg@mail.gmail.com>
 <4F80C739.2060404@gmail.com> <CAGa2bXZSgV3bRPGMt6Esw16v3ErVMLVQy1fb8cZxdc=OokpXKg@mail.gmail.com>
 <4F817DE1.3020608@gmail.com>
Date: Mon, 9 Apr 2012 05:58:42 +0900
Message-ID: <CAGa2bXYQ0r9mr7AfQZyN8iVzDXV2rca_eK=ZWgtt2iXGQFi5Bw@mail.gmail.com>
To: =?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?= <keisial@gmail.com>
Cc: PHP Developers Mailing List <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] PHP class files without <?php at the top
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

You are missing my points.

2012/4/8 =C1ngel Gonz=E1lez <keisial@gmail.com>:
> 2012/4/8, Yasuo Ohgaki:
>> 2012/4/8 =C1ngel Gonz=E1lez <keisial@gmail.com>:
>>> How does it help security?
>>> If any, requiring '<?php' before executable code makes easier to filter
>>> out malicious files on apps with uploads in case there's a local
>>> inclusion vulnerability somewhere.
>>>
>> Attackers may inject PHP script almost anything/anywhere since
>> PHP code may be embed anywhere in a file.
>>
>> For example, malicious PHP script may be in GIF something like
>>
>> gif89a ...any data.. <?php exec('rm -rf /') ?>
>>
>> and all attacker have to do is include/require the data somehow.
>> Attacker cannot do that this for other languages, since they are
>> not a embedded language. I know case that attackers may inject
>> malicious perl/ruby script in data files, but PHP is too easy
>> compare to these languages.
>>
>> Regards,
>>
>> --
>> Yasuo Ohgaki
> Yes, but if I properly check that there's no '<?php' in the uploaded file=
s
> (as you should verify everything you allow users to upload), it can't be
> exploited.
> OTOH if the vulnerable include is not an include but an include_code,
> they could
> use a file which was

Checking "<?php" is not enough obviously.
One should check "<?" and "<%" also and there are many data
files that may contain "<?" and "<%".

Embedding PHP script in image file is popular attack method.
There is even program called image fight that inject "<?php die()?>"
into uploaded images to prevent hosting malware images.

Attacker may inject PHP script into anywhere/any file. Disabling
embed mode is simple and effective countermeasure.

>> exec("rm -rf"); // Example of what not to do
> And was happily uploaded as "plain text".

There are 2 types of attacks, one is directly uploading PHP script.
Another is include PHP script. Uploading as plain text does not help.

Regards,

--
Yasuo Ohgaki