Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82006
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.176 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAEZPtU7vuygaLPGdE-T8Ep_-GTg_Vzsggb1BRgjSHhU09n7z+w@mail.gmail.com>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
 <CAGa2bXbf=hzbZ9eH6JVnMM0+6OeTQvAoqBe44g8qxFAAr9u9Kw@mail.gmail.com>
 <CAG1choq8S_EkdS22SFO+443u_LYVB-Z-b2ra6RK8sDhrJKc-VQ@mail.gmail.com>
 <CAGa2bXbJyK=2GCmGDw7PAh0ib=EL9GO7FFGf0X6VyAWqfR8EAA@mail.gmail.com>
 <CADajX4CHHdSpUfLfjhwrtdzmJfg9di4FpfeVEzBG4P7K7B+e0w@mail.gmail.com>
 <CAPwsocGh_-SYiWceEg=5go8G1bUs+CWUBb9uv_2Oh7AZhBxd8A@mail.gmail.com>
 <CAGa2bXY36wVN50sQ=MTYi+X6664+NYqMhsYFVZ9jeFZ1DXBg9Q@mail.gmail.com>
 <CAEZPtU5=vJG6=cguZfcT6RBriu8GT9vfW=Lqva8-XfEnXzZ23Q@mail.gmail.com>
 <CAGa2bXarZ4A9+HPXniAvBxEtE9KEJTYHHW8aYHCkBsNN5dRNUw@mail.gmail.com>
 <CAEZPtU4ThQHcH1hsgYaKwd2yOKAGP7obmcDH15qbDVr6CdgzSQ@mail.gmail.com>
 <CAGa2bXbWZJ--nkPaskRfCB91wqXSfY7LCwTefVa-ERxaY2r8Nw@mail.gmail.com>
 <CAEZPtU6mhc4asyeiab8RmFwBcUT873eXB1EPoePswQ0Xw0392g@mail.gmail.com>
 <CAGa2bXbcrS339yoyg4q3GakaGHSuc5Ga_Rd4A3E7=50xKRhfrw@mail.gmail.com>
 <CAEZPtU7Ywfha2BLXR+rrOc5ZdV4rEuxyAFvNddngR8jyEPH=Aw@mail.gmail.com>
 <CAGa2bXbygxH8=Con3_OckFW4V+WmD97axAZ+VOo2rnrY8gz12g@mail.gmail.com> <CAEZPtU7vuygaLPGdE-T8Ep_-GTg_Vzsggb1BRgjSHhU09n7z+w@mail.gmail.com>
Date: Fri, 6 Feb 2015 13:08:46 +0900
Message-ID: <CAGa2bXbfrAw6P5=cFA3bWUZ3rxm9aquCODB5+e=ZR6NUzY+y_A@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Adam Harvey <aharvey@php.net>, PHP internals <internals@lists.php.net>, Leigh <leight@gmail.com>, 
	reeze <reeze@php.net>
Content-Type: multipart/alternative; boundary=001a11c2cc9a2753be050e63960f
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] script() and script_once()
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c2cc9a2753be050e63960f
Content-Type: text/plain; charset=UTF-8

Hi Pierre,

On Fri, Feb 6, 2015 at 12:40 PM, Pierre Joye <pierre.php@gmail.com> wrote:

> > Even if uploaded files are stored under non web root dir, attackers can
> use
> > path
> > traversal or even full path with bad code. As long as PHP can access,
> > attacker
> > can access to files for inclusion attacks. Compression/encryption
> prevents
> > attack files executing via script()/require(). Does this answer to you?
>
> Not really. One will have to use exec and call php and the desired
> file as a well configured server won't allow exec of php in the upload
> or tmp dir, via the web server. It does not mean they are outside a
> web doc root, only that no php (or other) will ever be executed from
> there.
>

With SElinux, we can restrict access. However, PHP should be able to
read/write
uploaded files. PHP just read and execute them with include.

Is windows possible to prevent PHP to load script and execute? While
allowing write/read access?

I have similar idea for PHP to have data only dirs.


>
> Also PHP is one part of the big picture, so I will simply summarize it
> as "as long as one can access" instead of "as long as PHP can access".
> That says all we need to know about emulating (badly anyway) OS
> security features in PHP.
>
> > I realized that I didn't think of byte compiler format. I have to
> research
> > it.
> > IIRC, Zend allows to have custom script loader.
> > Could anyone give some pointers to look around? or give some ideas?
>
> PHK and Phar f.e.


Thank you. I'll check PHK.
I guess I should check Zend product, too.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c2cc9a2753be050e63960f--