Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72503
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.176 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <52FB1F9C.9090609@lsces.co.uk>
References: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com>
 <CAGa2bXZCBxJczqX6FKz0T0_iV9LzdeHkw46c17NQsanuCCJ9rA@mail.gmail.com>
 <52FA67A4.3030708@lerdorf.com> <CAGa2bXaHTCx+8=BJH-L+KqANo9NtEML3cp2sJqgv1jmGLYXaGg@mail.gmail.com>
 <52FAB58E.3080701@lsces.co.uk> <CAGa2bXbSD2xnOfptvZZu5Bj-L1LV5n213xB5C=haAd1vX8dfog@mail.gmail.com>
 <52FB0920.8040903@lsces.co.uk> <52FB0D15.9040303@lsces.co.uk>
 <CAGa2bXZx9Q6Lzd8PyDMrgudSH22uiHzJhkk+YEeu2Zue4dQeBQ@mail.gmail.com> <52FB1F9C.9090609@lsces.co.uk>
Date: Wed, 12 Feb 2014 17:04:29 +0900
Message-ID: <CAGa2bXYBvNF3VxWaNCDnoqee7rVP0To0sG9ghDL03SAHG8amUg@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b8743a41448fe04f231080a
Subject: Re: [PHP-DEV] Re: [RFC] No PHP tags
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--047d7b8743a41448fe04f231080a
Content-Type: text/plain; charset=UTF-8

Hi Lester,

On Wed, Feb 12, 2014 at 4:15 PM, Lester Caine <lester@lsces.co.uk> wrote:

> Yasuo Ohgaki wrote:
>
>>     Have you actually looked at the 'Some recent LFI issues' that are
>> listed? I
>>     don't thing any one of them would have been protected from by this
>> change?
>>     Providing a php page that can DISPLAY or run any file that it can
>> read is
>>     not going to be protected from by switching embedding off?
>>
>> 1st one is file upload vulnerability. I'll replace it something else.
>> 2nd one is
>>
>> http://seclists.org/bugtraq/2012/Apr/53
>>      $filepath = "$path_to_citrus/$load.php";
>>                  if (file_exists($filepath)) {
>>                          include('./'.$load.'.php');
>>
>> I'm not sure what they are loading. script() prevents from reading
>> /etc/passwd
>> or any other files.
>>
>
> Since it is loading a .php file there has to be a valid .php file to load?
> This is simply another file upload vulnerability?
>

Oops, I didn't care much about details of LFI reported.
You can find many valid examples here or any other similar sites. Unknown
LFI would be countless.

http://packetstormsecurity.com/search/?q=LFI


3 and 4 as far as I can see expected the files being loaded to contain
> embedded php, and so the environment needed to be secured better and the
> application rewritten. I accept simply disabling php would have blocked the
> hole, but it also would stop the whole application working? Certainly
> onefilecms has been completely reworked and is no longer vulnerable ... as
> far as I can see ... I've not looked at the other app now.
>

As an one of security auditor, I would recommend rewrite. They must have
strong input validation in first place. The reason why these are reported
as security vulnerability is nature of include()/require(). Vulnerability
reporters even reports invalid attack vectors for current PHP that requires
null bytes to attack.

Original author of this RFC was tried to resolve this issue by switching
mode. Although, I like the original idea, current RFC is trying to resolve
this issue by script().


> I still don't see how - short of switching off embedding permanently - you
> will stop critics with ulterior motives from calling PHP insecure? Other
> than that one element, php is as at risk as the other languages. Once
> embedding is switched off either by calling the file using 'script()' (
> which I view would transparently switch embedding off so not need any ini
> switch! ) or by the physical ini switch, then yes PHP is any other
> language, so if they are so worried about it ... use something else?
>

Original RFC was aimed to change require()/include() behavior and protect
applications without rewriting most of code, as few as 3 lines. I changed
the RFC not to change require()/include() behavior. The switch exists for
consistency between directly loaded and indirectly loaded scripts.
Consistency matters for languages, especially for new features. IMHO.

I could almost be convinced about the 'script()' option, but I would then
> insist the loaded file HAD <?php at the top and any other php tag would
> flag an error. It was loosing that 'security blanket' in the other rfc that
> grated ... but I don't see the point of the ini switch unless at some point
> you want to disable embedding permanently :(


It could be made raise error. It's valid option. Top "<?php" is allowed for
easier transition, mitigation for script exposure by miss configuration and
consistency.
It may be better to have more options to vote or back to original proposal?

I don't mind changing the RFC to original form.
It's clean, simple, compatible and easy to adopt. Drawback is 2 parsing
mode for include()/require() which could be problematic.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--047d7b8743a41448fe04f231080a--