Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82404
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.180 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAB6YZuxmMBQbVKYFcpH=2Yb0cOBoRSsZLritfV1-VkHrBm=Nbw@mail.gmail.com>
References: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com>
 <CAB6YZuxmMBQbVKYFcpH=2Yb0cOBoRSsZLritfV1-VkHrBm=Nbw@mail.gmail.com>
Date: Wed, 11 Feb 2015 09:29:50 +0900
Message-ID: <CAGa2bXbff7yQ_X5-9FVXNJzgOqVOpiO6h-OYFx=RMP5-f6X1QA@mail.gmail.com>
To: =?UTF-8?Q?Pavel_Kou=C5=99il?= <pajousek@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c1fd4c5d4bad050ec51c3f
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Script only includes
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c1fd4c5d4bad050ec51c3f
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Pavel,

On Tue, Feb 10, 2015 at 7:06 PM, Pavel Kou=C5=99il <pajousek@gmail.com> wro=
te:

> IMHO the real solution to this problem is to educate the programmers
> how to write safer applications, not by ini settings.
>

We have been tried to educate users already and introduced some
mitigations e.g. allow_url_include, open_basedir.

However, enough time is passed to prove that wasn't enough, isn't it?

PHP (many and these are _only_ few of them in the wild)
http://www.exploit-db.com/search/?action=3Dsearch&filter_page=3D1&filter_de=
scription=3DPHP&filter_author=3D&filter_platform=3D0&filter_type=3D0&filter=
_lang_id=3D0&filter_exploit_text=3Dinclusion&filter_port=3D0&filter_osvdb=
=3D&filter_cve=3D

PERL (0 result)
http://www.exploit-db.com/search/?action=3Dsearch&filter_page=3D1&filter_de=
scription=3D&filter_exploit_text=3DPERL&filter_author=3Dinclusion&filter_pl=
atform=3D0&filter_type=3D0&filter_lang_id=3D0&filter_port=3D&filter_osvdb=
=3D&filter_cve=3D

Rails (0 result)
http://www.exploit-db.com/search/?action=3Dsearch&filter_page=3D1&filter_de=
scription=3DRails&filter_exploit_text=3Dinclusion&filter_author=3D&filter_p=
latform=3D0&filter_type=3D0&filter_lang_id=3D0&filter_port=3D&filter_osvdb=
=3D&filter_cve=3D

Python (0 result)
http://www.exploit-db.com/search/?action=3Dsearch&filter_page=3D1&filter_de=
scription=3DPython&filter_exploit_text=3Dinclusion&filter_author=3D&filter_=
platform=3D0&filter_type=3D0&filter_lang_id=3D0&filter_port=3D&filter_osvdb=
=3D&filter_cve=3D

JSP (1 result - This is famous)
http://www.exploit-db.com/search/?action=3Dsearch&filter_page=3D1&filter_de=
scription=3DJSP&filter_exploit_text=3Dinclusion&filter_author=3D&filter_pla=
tform=3D0&filter_type=3D0&filter_lang_id=3D0&filter_port=3D&filter_osvdb=3D=
&filter_cve=3D

The picture is clear.

I value education as one of the most important security measure indeed.

However, education is not perfect. If there is effective counter measure,
it
is better to be adopted. We can write web apps by PHP, not only because
it's faster to write, but easier to write secure code.

We removed "script embedding" from regex functions, why not include?
My new proposal is simple and does not require performance penalty.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c1fd4c5d4bad050ec51c3f--