Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81892
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.179 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXY36wVN50sQ=MTYi+X6664+NYqMhsYFVZ9jeFZ1DXBg9Q@mail.gmail.com>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
	<CAGa2bXbf=hzbZ9eH6JVnMM0+6OeTQvAoqBe44g8qxFAAr9u9Kw@mail.gmail.com>
	<CAG1choq8S_EkdS22SFO+443u_LYVB-Z-b2ra6RK8sDhrJKc-VQ@mail.gmail.com>
	<CAGa2bXbJyK=2GCmGDw7PAh0ib=EL9GO7FFGf0X6VyAWqfR8EAA@mail.gmail.com>
	<CADajX4CHHdSpUfLfjhwrtdzmJfg9di4FpfeVEzBG4P7K7B+e0w@mail.gmail.com>
	<CAPwsocGh_-SYiWceEg=5go8G1bUs+CWUBb9uv_2Oh7AZhBxd8A@mail.gmail.com>
	<CAGa2bXY36wVN50sQ=MTYi+X6664+NYqMhsYFVZ9jeFZ1DXBg9Q@mail.gmail.com>
Date: Thu, 5 Feb 2015 17:24:41 +0700
Message-ID: <CAEZPtU5=vJG6=cguZfcT6RBriu8GT9vfW=Lqva8-XfEnXzZ23Q@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Leigh <leight@gmail.com>, Adam Harvey <aharvey@php.net>, reeze <reeze@php.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] script() and script_once()
From: pierre.php@gmail.com (Pierre Joye)

On Thu, Feb 5, 2015 at 5:20 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Leigh,
>
> On Thu, Feb 5, 2015 at 5:31 PM, Leigh <leight@gmail.com> wrote:
>
>> On 5 February 2015 at 05:37, Adam Harvey <aharvey@php.net> wrote:
>> > I'm not totally clear on what this RFC is proposing, honestly. Is the
>> > new script statement meant to only include files that are entirely
>> > wrapped in <?php and ?> tags? Are files included that way assumed to
>> > be PHP and don't require <?php and ?> tags? Something else?
>> >
>>
>> This is my initial reaction to the RFC, it doesn't state the
>> _specific_ difference between include/script. I understand what was
>> proposed in the nophptags RFC, but I have to make an assumption for
>> this RFC.
>>
>> My assumption is that you want script* to not require <?php to begin
>> parsing. i.e. including /etc/passwd would be a parse failure.
>
>
> I'm proposing *SCRIPT* only inclusion. This can be done by
>
>  - allowing "<?php" only at to top of script
>  - not allowing "?>" anywhere (We may allow at the end possibly)
>
> Those who do not understand my point.
> Please search by "PHP LFI" or "PHP file inclusion" for real life
> security issues.

I do understand what you try to achieve, from all point of view.
However I strongly disagree with this as a security improvement. I see
this more as yet another attempt to replace what should be done at the
OS level.

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org