Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81998
Return-Path: <yohgaki@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 34316 invoked from network); 6 Feb 2015 02:08:23 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 6 Feb 2015 02:08:23 -0000
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.49 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@gmail.com
X-Host-Fingerprint: 209.85.216.49 mail-qa0-f49.google.com  
Received: from [209.85.216.49] ([209.85.216.49:45806] helo=mail-qa0-f49.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id EE/9A-17766-61224D45 for <internals@lists.php.net>; Thu, 05 Feb 2015 21:08:22 -0500
Received: by mail-qa0-f49.google.com with SMTP id v8so8777459qal.8
        for <internals@lists.php.net>; Thu, 05 Feb 2015 18:08:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:sender:in-reply-to:references:from:date:message-id
         :subject:to:cc:content-type;
        bh=6Wkam1S4zdKZ5jqro9P57uwrLmLpZm25lA5f9yl0+A8=;
        b=hrPDYXRlLvtIgd/Az2zpS4aDlXdoriNm4JoXWEsmxhaNdHzFWKV/QN6xahM3jA39Bj
         dJRpAl+pT2akevglD2A8BYTjIawHpUUuIKleRN10vPONON45SBDurqST2hVbTXBstXaI
         RpzZzQ6z+w953dNsHf/9PhDeZTt7OifFQtzqGtbiVJqViBMAZH22RM8J1MxvhWQgEPyo
         FxAHtSoGK9kDQb7cpzulwhtO6dyhTbkELZVDS67mlpvTEt+sUAxykOkXAF1hNQFAUhnT
         kDvV9jhCcO759+wQ+EE2A9FTD2r/jxrdflJPhJ9BwD/3YEtRdCTkXpeVXXssq7ul9w2a
         hD8g==
X-Received: by 10.224.161.138 with SMTP id r10mr2955877qax.21.1423188499597;
 Thu, 05 Feb 2015 18:08:19 -0800 (PST)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Received: by 10.229.28.72 with HTTP; Thu, 5 Feb 2015 18:07:39 -0800 (PST)
In-Reply-To: <CAEZPtU6mhc4asyeiab8RmFwBcUT873eXB1EPoePswQ0Xw0392g@mail.gmail.com>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
 <CAGa2bXbf=hzbZ9eH6JVnMM0+6OeTQvAoqBe44g8qxFAAr9u9Kw@mail.gmail.com>
 <CAG1choq8S_EkdS22SFO+443u_LYVB-Z-b2ra6RK8sDhrJKc-VQ@mail.gmail.com>
 <CAGa2bXbJyK=2GCmGDw7PAh0ib=EL9GO7FFGf0X6VyAWqfR8EAA@mail.gmail.com>
 <CADajX4CHHdSpUfLfjhwrtdzmJfg9di4FpfeVEzBG4P7K7B+e0w@mail.gmail.com>
 <CAPwsocGh_-SYiWceEg=5go8G1bUs+CWUBb9uv_2Oh7AZhBxd8A@mail.gmail.com>
 <CAGa2bXY36wVN50sQ=MTYi+X6664+NYqMhsYFVZ9jeFZ1DXBg9Q@mail.gmail.com>
 <CAEZPtU5=vJG6=cguZfcT6RBriu8GT9vfW=Lqva8-XfEnXzZ23Q@mail.gmail.com>
 <CAGa2bXarZ4A9+HPXniAvBxEtE9KEJTYHHW8aYHCkBsNN5dRNUw@mail.gmail.com>
 <CAEZPtU4ThQHcH1hsgYaKwd2yOKAGP7obmcDH15qbDVr6CdgzSQ@mail.gmail.com>
 <CAGa2bXbWZJ--nkPaskRfCB91wqXSfY7LCwTefVa-ERxaY2r8Nw@mail.gmail.com> <CAEZPtU6mhc4asyeiab8RmFwBcUT873eXB1EPoePswQ0Xw0392g@mail.gmail.com>
Date: Fri, 6 Feb 2015 11:07:39 +0900
X-Google-Sender-Auth: 814rxpDTm9GxjyJfJ7CO8hzTB_U
Message-ID: <CAGa2bXbcrS339yoyg4q3GakaGHSuc5Ga_Rd4A3E7=50xKRhfrw@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Leigh <leight@gmail.com>, Adam Harvey <aharvey@php.net>, reeze <reeze@php.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e014953ecf79095050e61e47e
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] script() and script_once()
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e014953ecf79095050e61e47e
Content-Type: text/plain; charset=UTF-8

Hi Pierre,

On Fri, Feb 6, 2015 at 10:39 AM, Pierre Joye <pierre.php@gmail.com> wrote:

> I do not put high value in this ISO ;-)
>

I am :)  Almost all of my clients are ISMS or similar certified.

However, back to this exact feature. I am not convinced it is the
> right way, there are many cases required more than just checking valid
> code (<?php ...), like bash bang lines, phar or other script
> archives-like solutions. And even with this solution, a compromised
> server (via a web app or other) could still do whatever they want with
> php scripts if the web server is not configured correctly.
>

With this proposal, <?php is allowed only at the top of a file.
For example, one of the easiest way to take over servers is embed
script into session data files. This is prevented effectively.

Users who allows phar/etc file uploads, they may have encryption or
compression as mitigation. This mitigation works well, but we cannot
enforce all users to adopt. It requires additional code/CPU resource...
It may ruin usability also. e.g. Files compressed by lzo or any other
fancy algorithms are not easily accessed.

I suggest users to configure their OS to protect all kinds of file
reading/writing
attacks. I agree 100%.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e014953ecf79095050e61e47e--