Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82354
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.179 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com>
References: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com>
Date: Tue, 10 Feb 2015 16:19:18 +0700
Message-ID: <CAEZPtU500iTsny5wtSeRFkO2jyk1Y6p9BRwttPpBt38Ebp_cFg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Script only includes
From: pierre.php@gmail.com (Pierre Joye)

On Tue, Feb 10, 2015 at 7:52 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> Some of you are tired with this topic, but please take a look the RFC
>
> [RFC] Script only includes - this is 3rd version.
> https://wiki.php.net/rfc/script_only_include
>
> Please let me know what you like or dislike.

I said before but this RFC tries to solve a problem using yet another
"security" feature in the engine while the OS and the webserver
provides way better solutions without adding a possible new pandora
box from a security point of view.  Many extensions may have to deal
with it too. I can only create an empty for all upcoming CVEs about
xyz not following script_embed. Alone that tells me that we should not
try again to make php "more secure" using such features.

I suppose script_embed ini setting is siimilar to open_basedir but for
exec only, which would prevent any script to be exec'ed (require,
include, via handlers but works for fopen&co) while open_basedir would
remain the same (aka also for fopen&co). Now, that does prevent one to
shoot himself in the foot, eval(file_get_contents());. Yes, this is
stupid thing to do, just a bit more stupid that require
"someuploadedfile"; but not much more. Trying to implement security
measures to prevent people to exec codes from an unknown file is a bad
idea. They will do it one way or another. And if anyone application
still do include/require(random/uploaded files), then they surely have
many other problems to solve but none of them is really a php problem.

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org