Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72833
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.46 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <530DD588.1000407@sugarcrm.com>
References: <CAGa2bXYO=Q3pmYKYOt0qudFtzimrXitJoLcB4KZ80MYJ-nJo0A@mail.gmail.com>
 <CAF+90c9umjqfiW3780hPjk_LpbyV=fT2t=bXZxWhiSDN-yuiuA@mail.gmail.com>
 <CAGa2bXZcs-zq7afbY9dqvOcnQ0q1MAC0muO3VNSfxzMnL4_hCg@mail.gmail.com>
 <530C3C7B.8080907@sugarcrm.com> <CAGa2bXYyxrLXxT812=s_s7zB+En1mfAJy9du90+Yt7OPZYjdvA@mail.gmail.com>
 <530C77F8.2060809@sugarcrm.com> <1393328380.5233.45.camel@guybrush> <530DD588.1000407@sugarcrm.com>
Date: Thu, 27 Feb 2014 06:23:32 +0900
Message-ID: <CAGa2bXa_kYvqKz_6imjFPb0KLuKJzVJEgTHKmrWG7kH75eQnHQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: =?UTF-8?Q?Johannes_Schl=C3=BCter?= <johannes@schlueters.de>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c3ce3275541804f355d3ff
Subject: Re: [PHP-DEV] Resolution for ver_export()/addslashes() encoding based
 script execution attack?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c3ce3275541804f355d3ff
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Wed, Feb 26, 2014 at 8:52 PM, Stas Malyshev <smalyshev@sugarcrm.com>wrote:

> > The situation around var_export() is a bit more complicated.
> > var_export() is used to create application configuration, cache data
> > etc. so one might expect the PHP which created that to be able to read
> > that, again. Doing this isn't easy, though, as it makes the generated
> > file non-portable.
>
> Are you suggesting if var_export generates the data it may not be
> readable by standard PHP? Or by PHP running with specific
> script_encoding like SJIS? If the latter, I think var_export to generate
> valid SJIS data is hard to achieve, since SJIS is not ASCII-compatible.


I think you've mailed this before reading my mail to you.

PHP supports SJIS and the like. Escape functions should provide safe
escaping like databases. The only way to solve this issue is encoding aware
escape which databases adopted years ago. I'm proposing known vulnerability
with known method to fix.

BTW, users who do not have to worry about this are not affected by proposed
change.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c3ce3275541804f355d3ff--