Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74663
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.43 as permitted sender)
MIME-Version: 1.0
Sender: are.you.winning@gmail.com
In-Reply-To: <757B91CA-9378-4FAC-8461-0105694291FD@ajf.me>
References: <757B91CA-9378-4FAC-8461-0105694291FD@ajf.me>
Date: Sat, 31 May 2014 17:43:40 +0100
Message-ID: <CAGAGxbZeZsiwf1Sr=QwUOTSP-r63bfooRnLzg8bYkUzKGYdjnQ@mail.gmail.com>
To: Andrea Faulds <ajf@ajf.me>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] CURLOPT_SAFE_UPLOAD and PHP 5.6
From: cw@daverandom.com (Chris Wright)

Hi Andrea

On 31 May 2014 15:19, Andrea Faulds <ajf@ajf.me> wrote:
> Good afternoon,
>
> Stas=E2=80=99s =E2=80=98Fix CURL file uploads=E2=80=99 RFC was approved a=
nd implemented in PHP 5.5:
>
> https://wiki.php.net/rfc/curl-file-upload
>
> It deals with the quite serious security issue caused by the behaviour of=
CURLOPT_POSTFIELDS where the =E2=80=98@=E2=80=98 prefix before a path speci=
fies a file upload, making it unsafe to pass user data to CURLOPT_POSTFIELD=
S without checking for =E2=80=98@=E2=80=98 first. It fixes this by adding a=
 new way to specify a file (the CURLFile object) and by adding a new option=
, CURLOPT_SAFE_UPLOAD, which can be set to true (but is false by default) w=
hich disables the =E2=80=98@=E2=80=98 prefix.
>
> What I=E2=80=99m wondering about is the status of the default value of th=
e CURLOPT_SAFE_UPLOAD constant in the PHP-5.6 branch. The RFC specifies tha=
t it should be set to true by default in PHP 5.6, but I don=E2=80=99t know =
if this has actually been implemented. I can=E2=80=99t understand the cURL =
source well enough to see if this is the case. Could someone inform me?
>

It has been altered in 5.6 as specified. See:

5.5: http://lxr.php.net/xref/PHP_5_5/ext/curl/interface.c#1806
5.6: http://lxr.php.net/xref/PHP_5_6/ext/curl/interface.c#1798

Details of the change have also been added to the UPGRADING notes for 5.6

> If it=E2=80=99s still false, I think it is imperative that we make sure t=
he it is true by default by the time PHP 5.6 is released. While this will b=
reak code that relied on =E2=80=98@=E2=80=98, PHP 5.5 has been out for quit=
e a while now, and the fix is very simple to implement. The very considerab=
le security benefits trump the inconvenience of changing existing code here=
, IMHO. Existing code can be fixed very easily, either by using the CURLFil=
e class if targeting only PHP 5.5+, or by setting CURLOPT_SAFE_UPLOAD to fa=
lse, both of which are single-line changes.
>
> So, does anyone know what the status in PHP-5.6 is?
>
> Thanks!
> --
> Andrea Faulds
> http://ajf.me/
>

Thanks, Chris