Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72446
Return-Path: <yohgaki@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 4488 invoked from network); 10 Feb 2014 21:40:58 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 10 Feb 2014 21:40:58 -0000
Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.180 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@gmail.com
X-Host-Fingerprint: 209.85.217.180 mail-lb0-f180.google.com  
Received: from [209.85.217.180] ([209.85.217.180:57564] helo=mail-lb0-f180.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 51/29-57220-96749F25 for <internals@lists.php.net>; Mon, 10 Feb 2014 16:40:58 -0500
Received: by mail-lb0-f180.google.com with SMTP id n15so5185748lbi.39
        for <internals@lists.php.net>; Mon, 10 Feb 2014 13:40:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:sender:in-reply-to:references:from:date:message-id
         :subject:to:cc:content-type;
        bh=RSXdlB8u2cUPfMU0PC2yq+bK0nowP0XFSIvGX4cXGYM=;
        b=gdX/LAbwK0lTYtYgoKEuahLc4trgxm/vtVNYt6OnZQhhWIGIg2qdT3dr9PO2C0YeJ6
         d+3MyCudwmYTipsqkUXv1NddmGC6jWUACyxGttJ2ZBCEBanS7r0xGmrHI6Jv4W8K8bHr
         iYk2gdGL7zxA6vVx/C2UYKTJZbILCF9JHDkVwF/o4n1l8QZ85XIdDB0NTR5xcEpYXiQZ
         41C+LO2xLc1Yv/C45VgRwgdeiSFhheskk72IkHDgqSZdFH2YdsCnne/BJAaqxVbfdsK5
         2emr9D//kFnGq/i+MfpHE0UtI0+RJ/FazC7kmmwNdZPVmMtsvtpj+iJKeqzWh8dbj1EB
         8zlQ==
X-Received: by 10.112.160.200 with SMTP id xm8mr22430705lbb.24.1392068454271;
 Mon, 10 Feb 2014 13:40:54 -0800 (PST)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Received: by 10.112.199.37 with HTTP; Mon, 10 Feb 2014 13:40:12 -0800 (PST)
In-Reply-To: <52F88A5C.4010909@lerdorf.com>
References: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com>
 <52F88A5C.4010909@lerdorf.com>
Date: Tue, 11 Feb 2014 06:40:12 +0900
X-Google-Sender-Auth: P68drx62mDdTAuP3xcTUxrpd8cQ
Message-ID: <CAGa2bXbHLkbR8CmBqn9w2rUkLySNqhQHk_ZibL0hOjnR-_0_Ng@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c24896b8544904f21431c5
Subject: Re: [PHP-DEV] [RFC] No PHP tags
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c24896b8544904f21431c5
Content-Type: text/plain; charset=UTF-8

Hi Rasmus,

On Mon, Feb 10, 2014 at 5:14 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:

> I think this would actually weaken security. Having two very different
> parsing modes means that if you mix the modes and include a file in one
> mode meant to be included in the other would leak the source code to the
> world which is arguably a worse security issue than the sloppy coding
> issue you are trying to prevent here.
>

I agree that having 2 parsing modes is problematic.
Users may avoid this by having "<?php" at the top always. I'll write
"<?php" always and it should be recommended for maximum security.

Even though there is downside, it has advantage to consider.
There are scripts out there that suffer LFI due to embed by default.
If other languages have the same issue, I don't care much. PHP is the only
one which is affected a lot. Other languages have the same issue, but
it's under very limited context.

The main objective of this RFC is to make PHP as secure as other languages
with respect to LFI. It's one of the reason why some companies do not adopt
PHP as their platform and I would like to change it.

Perhaps, we may force to write "<?php" even when script only mode?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c24896b8544904f21431c5--