Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82035
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.41 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <54D47B97.2080204@lsces.co.uk>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
 <CAGa2bXarZ4A9+HPXniAvBxEtE9KEJTYHHW8aYHCkBsNN5dRNUw@mail.gmail.com>
 <CAEZPtU4ThQHcH1hsgYaKwd2yOKAGP7obmcDH15qbDVr6CdgzSQ@mail.gmail.com>
 <CAGa2bXbWZJ--nkPaskRfCB91wqXSfY7LCwTefVa-ERxaY2r8Nw@mail.gmail.com>
 <CAEZPtU6mhc4asyeiab8RmFwBcUT873eXB1EPoePswQ0Xw0392g@mail.gmail.com>
 <CAGa2bXbcrS339yoyg4q3GakaGHSuc5Ga_Rd4A3E7=50xKRhfrw@mail.gmail.com>
 <CAEZPtU7Ywfha2BLXR+rrOc5ZdV4rEuxyAFvNddngR8jyEPH=Aw@mail.gmail.com>
 <CAGa2bXbygxH8=Con3_OckFW4V+WmD97axAZ+VOo2rnrY8gz12g@mail.gmail.com>
 <CAEZPtU7vuygaLPGdE-T8Ep_-GTg_Vzsggb1BRgjSHhU09n7z+w@mail.gmail.com>
 <CAGa2bXbfrAw6P5=cFA3bWUZ3rxm9aquCODB5+e=ZR6NUzY+y_A@mail.gmail.com>
 <CAEZPtU5hEzyNZkNKcmPY4pfrL1Nc-Dzsu3-ogXtuhimCOgsj5Q@mail.gmail.com>
 <CAGa2bXaGrR9mPGDVEzEMX3uXJuRq5Fgqn4tDqttzSKN8RSpnYg@mail.gmail.com>
 <CAEZPtU7Lmk8U3E-_p-85AF9M_Y9=66H596uQT2kdTD4Kn3bH_g@mail.gmail.com>
 <CAGa2bXbropYSqbqAN+7HV5NPpJFSNajndF4X0GJhRfMnLc5fPg@mail.gmail.com> <54D47B97.2080204@lsces.co.uk>
Date: Fri, 6 Feb 2015 19:11:33 +0900
Message-ID: <CAGa2bXbJpwi9y7itLMLn_7pHzAYbzFVGhh6BAXt_tD7O1idiPg@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2cc9a8b18cd050e68a7fc
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] script() and script_once()
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c2cc9a8b18cd050e68a7fc
Content-Type: text/plain; charset=UTF-8

Hi Lester and all,

On Fri, Feb 6, 2015 at 5:30 PM, Lester Caine <lester@lsces.co.uk> wrote:

> On 06/02/15 05:01, Yasuo Ohgaki wrote:
> >> But it is the key point. It is not PHP role to do it. PHP is not
> >> > alone. It is a server configuration job. But I have said that already
> >> > many times, we got our points :)
>
> > I understand your point.
> >
> > We need both OS and PHP feature for perfection. Both of them are
> required.
> >
> > Current PHP just reads & executes all accessible files by include.
> > I think you understand my point, too :)
>
> The question is essentially CAN one prevent PHP on it's own from running
> things it shouldn't. In order to prevent people who do not understand
> the security risks from 'making a mistake'. The answer is probably only
> yes for a distribution that only comes from PHP. Other distributions are
> not following guidelines now so expecting them to do in the future is
> questionable? This is more about education of the whole infrastructure
> but I don't see the point of yet another load mechanism? I thought we
> had introduced all the necessary restrictions on include and require
> already? From a 'nannying' point of view I would have thought it was
> that hole which   needed plugging since the people you are trying to
> protect will not use a new mechanism anyway? I hope that I have my own
> installations configured such that one can't upload material on-line
> that can be accessed but having to ensure third party libraries are
> using 'script' rather than 'include/require' seems a little problematic ...


Apparently, we don't provide key feature to eliminate script/file inclusion
attack that is unique to PHP.

I think the best way to go is to make 'require()' script only.

We need config to specify "script directory" to control script only
inclusion.
PHP must need to know if a file allowed to  be executed. e.g.
require('../../file.php')
needs to know if it's safe to execute or not.

It must be fast. I'm thinking to cache all directory inode number specified
by "script directory" config at system initialization.

; All directories under these are script. Empty == disabled.
script_path="/var/www/lib;/var/www/html/"

; All directory under these ares files cannot be executed as script
; We don't need "engine=Off" for these directories any more.
upload_path="/var/www/html/upload;/var/www/html/user_images"

I'm not sure strtmp() or inode cache is faster. I'll take benchmark
to see if this is acceptable.

Please note that directory path configs are needed because of customizable
Zend script loader. i.e. PHP script or not cannot be decide by file
contents.

I'll rewrite whole RFC later.

Comments are appreciated.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c2cc9a8b18cd050e68a7fc--