Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82002
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.54 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbygxH8=Con3_OckFW4V+WmD97axAZ+VOo2rnrY8gz12g@mail.gmail.com>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
	<CAGa2bXbf=hzbZ9eH6JVnMM0+6OeTQvAoqBe44g8qxFAAr9u9Kw@mail.gmail.com>
	<CAG1choq8S_EkdS22SFO+443u_LYVB-Z-b2ra6RK8sDhrJKc-VQ@mail.gmail.com>
	<CAGa2bXbJyK=2GCmGDw7PAh0ib=EL9GO7FFGf0X6VyAWqfR8EAA@mail.gmail.com>
	<CADajX4CHHdSpUfLfjhwrtdzmJfg9di4FpfeVEzBG4P7K7B+e0w@mail.gmail.com>
	<CAPwsocGh_-SYiWceEg=5go8G1bUs+CWUBb9uv_2Oh7AZhBxd8A@mail.gmail.com>
	<CAGa2bXY36wVN50sQ=MTYi+X6664+NYqMhsYFVZ9jeFZ1DXBg9Q@mail.gmail.com>
	<CAEZPtU5=vJG6=cguZfcT6RBriu8GT9vfW=Lqva8-XfEnXzZ23Q@mail.gmail.com>
	<CAGa2bXarZ4A9+HPXniAvBxEtE9KEJTYHHW8aYHCkBsNN5dRNUw@mail.gmail.com>
	<CAEZPtU4ThQHcH1hsgYaKwd2yOKAGP7obmcDH15qbDVr6CdgzSQ@mail.gmail.com>
	<CAGa2bXbWZJ--nkPaskRfCB91wqXSfY7LCwTefVa-ERxaY2r8Nw@mail.gmail.com>
	<CAEZPtU6mhc4asyeiab8RmFwBcUT873eXB1EPoePswQ0Xw0392g@mail.gmail.com>
	<CAGa2bXbcrS339yoyg4q3GakaGHSuc5Ga_Rd4A3E7=50xKRhfrw@mail.gmail.com>
	<CAEZPtU7Ywfha2BLXR+rrOc5ZdV4rEuxyAFvNddngR8jyEPH=Aw@mail.gmail.com>
	<CAGa2bXbygxH8=Con3_OckFW4V+WmD97axAZ+VOo2rnrY8gz12g@mail.gmail.com>
Date: Fri, 6 Feb 2015 10:40:55 +0700
Message-ID: <CAEZPtU7vuygaLPGdE-T8Ep_-GTg_Vzsggb1BRgjSHhU09n7z+w@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Adam Harvey <aharvey@php.net>, PHP internals <internals@lists.php.net>, Leigh <leight@gmail.com>, 
	reeze <reeze@php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] script() and script_once()
From: pierre.php@gmail.com (Pierre Joye)

On Fri, Feb 6, 2015 at 10:33 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Pierre,
>
> On Fri, Feb 6, 2015 at 11:13 AM, Pierre Joye <pierre.php@gmail.com> wrote:
>>
>> > I am :)  Almost all of my clients are ISMS or similar certified.
>>
>> Marketing ;)
>>
>> >> However, back to this exact feature. I am not convinced it is the
>> >> right way, there are many cases required more than just checking valid
>> >> code (<?php ...), like bash bang lines, phar or other script
>> >> archives-like solutions. And even with this solution, a compromised
>> >> server (via a web app or other) could still do whatever they want with
>> >> php scripts if the web server is not configured correctly.
>> >
>> >
>> > With this proposal, <?php is allowed only at the top of a file.
>>
>> So phar won't work with require_script? If that's the case then it does
>> look good to me.
>
> Good point! I'll add this to the RFC.
> I'm not too familiar to phar format.
>
> Uncompressed phar has <?php at the top. I think .phar should be treated as
> .php.
> Compressed phar can be syntax error. I need to consider more including byte
> compilers.
>
>> > For example, one of the easiest way to take over servers is embed
>> > script into session data files. This is prevented effectively.
>> >
>> > Users who allows phar/etc file uploads, they may have encryption or
>> > compression as mitigation.
>>
>> What does it have to do with upload?
>>
>> Uploads are and should not be in a folder where php can be executed. This
>> is a basic configuration issue on almost all web servers.
>
> I agree that files are better/should be located other than web root.
> Many apps only checks extension stores anything under web root.
>
> Even if uploaded files are stored under non web root dir, attackers can use
> path
> traversal or even full path with bad code. As long as PHP can access,
> attacker
> can access to files for inclusion attacks. Compression/encryption prevents
> attack files executing via script()/require(). Does this answer to you?

Not really. One will have to use exec and call php and the desired
file as a well configured server won't allow exec of php in the upload
or tmp dir, via the web server. It does not mean they are outside a
web doc root, only that no php (or other) will ever be executed from
there.

Also PHP is one part of the big picture, so I will simply summarize it
as "as long as one can access" instead of "as long as PHP can access".
That says all we need to know about emulating (badly anyway) OS
security features in PHP.

> I realized that I didn't think of byte compiler format. I have to research
> it.
> IIRC, Zend allows to have custom script loader.
> Could anyone give some pointers to look around? or give some ideas?

PHK and Phar f.e.


-- 
Pierre

@pierrejoye | http://www.libgd.org