Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59707
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <4F850D06.10701@sugarcrm.com>
References: <CAGa2bXZ6G=Cphjrde3u1Mq3AAw-4yJk3s28vNe+Aybt2nGTumg@mail.gmail.com>
 <CAGa2bXZh4uMeUH_BSCFmfNgxS-SZC0svA9BPcSROjwmbfrtFyQ@mail.gmail.com>
 <CAGa2bXbhi4zdgd9Udo6KsoycDwg_Ke0Xe5h3_-fVDMvn_VfAjQ@mail.gmail.com>
 <A633CF2D7C7BED41B41F1E64F25507B806A5CDD6C2@MAILR001.mail.lan>
 <CAGa2bXZKfQ+HqOucwOnBH7gV84hpdxZb5qNY3t3ThF_zMKSGHw@mail.gmail.com> <4F850D06.10701@sugarcrm.com>
Date: Wed, 11 Apr 2012 14:21:41 +0900
Message-ID: <CAGa2bXZWrRh8RdMtKK_2_U_XmByC-O6hGRPrJyW5KwvE0CAK-w@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: John Crenshaw <johncrenshaw@priacta.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Re: Disabling PHP tags by php.ini and CLI options
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

2012/4/11 Stas Malyshev <smalyshev@sugarcrm.com>:
> Hi!
>
>> https://wiki.php.net/rfc/nophptags?&#why_this_is_better_than_now
>
> I'm sorry, but I do not understand how your proposal prevents LFI. Let's
> say you had this file kill.php:
> <?php kill_kill_kill();

It's a common lazy technique that prevents unwanted script execution.
I've been using this as an additional security for a long time.
(It was common to me even before JSON hijack problem at least)

I'm sure you have seen the same code in JSON hijack countermeasure.

while(1){}

JS cannot kill script, so infinite loop is used.

>
> and you were afraid that somebody would write the code "include
> $_GET['foo'];" and pass kill.php as foo and kill your server. Now, you
> propose banning <?php tag. So, kill.php would look like this:
>
> kill_kill_kill();

We don't kill(), but validate with template_mode=off.
It's impossible injecting kill() into everywhere, but we can validate
file headers.

>
> and you still can include it with "include $_GET['foo'];" and get the
> same result. Where's the difference?

With template_mode=on, PHP behaves exactly the same as it is now.
The easiest way to prevent unwanted script execution is injecting kill()
at the beginning of file.

For files not under control, LFI just disclose it :(

With template_mode=off, all we have to do is making sure files have
valid (Non PHP code) header. Kill() injections are not required.

For files not under control, LFI results in syntax error almost always :)

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net