Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:65558
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain webstart.fr from 74.125.82.180 cause and error)
MIME-Version: 1.0
In-Reply-To: <510C03AE.2070903@sugarcrm.com>
References: <50FC9AC5.9070407@sugarcrm.com>
	<5106D92C.6020709@sugarcrm.com>
	<CAOfKkdR013mwtLqgEisnCg_t9n-OKBQeOAcqAmce+8wopbCcZg@mail.gmail.com>
	<510C03AE.2070903@sugarcrm.com>
Date: Fri, 1 Feb 2013 13:08:08 -0500
Message-ID: <CAOfKkdT+1gHQTAVgT_e0J9nhOoQEer=764ssz2Nf-wc+S9kV-g@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7ba979242b226004d4ada0b7
Subject: Re: [PHP-DEV] Re: [VOTE] CURLFile uploading API
From: pierrick@webstart.fr (Pierrick Charron)

--047d7ba979242b226004d4ada0b7
Content-Type: text/plain; charset=ISO-8859-1

Thanks for the example. Even if it's not frequent I agree that it doesn't
cost much to prevent this issue

Pierrick

On 1 February 2013 13:04, Stas Malyshev <smalyshev@sugarcrm.com> wrote:

> Hi!
>
> > I'm not against it but, just being curious, what are those security
> > reasons ?
>
> If you ever accepted serialized data from outside (say, after putting it
> in a cookie or just having API that accepts serialization) and then
> forwarded the same data array using cURL, the attacker could create
> serialized representation of CURLFile that would make cURL send out a
> file on your filesystem, which would be a security breach. Basically the
> same security problem as with @, only with serialization involved. It is
> not frequent case, but possible.
>
> --
> Stanislav Malyshev, Software Architect
> SugarCRM: http://www.sugarcrm.com/
> (408)454-6900 ext. 227
>

--047d7ba979242b226004d4ada0b7--