Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82439
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.176 as permitted sender)
Message-ID: <54DB0575.8020506@gmail.com>
Date: Tue, 10 Feb 2015 23:32:05 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Yasuo Ohgaki <yohgaki@ohgaki.net>, 
 "internals@lists.php.net" <internals@lists.php.net>
References: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com>
In-Reply-To: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Script only includes
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Some of you are tired with this topic, but please take a look the RFC
> 
> [RFC] Script only includes - this is 3rd version.
> https://wiki.php.net/rfc/script_only_include
> 
> Please let me know what you like or dislike.

I think there are several issues with this RFC:

1. It does not protect against all the problems it purports to protect.
I.e. if you want to protect against local PHP code accessing evil
uploaded files, local PHP code can also do echo
file_get_contents('/etc/paswd') and still have a problem (actually, very
common LFI issue).  Even if the application only allows to require
random file, it may be possible to inject data via other means - such as
data stream, URL, temp files, session files, etc. Upload is not the only
way inputs can be controlled.

2. Legitimate files can include <? as byte sequence - in fact, it is
almost guaranteed big enough binary file would contain it. Restricting
upload of such files would break uploading functionality on many sites.

3. General approach of this RFC is, given site with glaring security
hole in their code, give them a measure of protection against some of
the consequences. This looks like safe_mode approach, and that proved
ineffective in the past.
-- 
Stas Malyshev
smalyshev@gmail.com