Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83488
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.169 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Date: Mon, 23 Feb 2015 06:23:35 +0900
Message-ID: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11353862655b70050fb3e8a3
Subject: [RFC] Script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11353862655b70050fb3e8a3
Content-Type: text/plain; charset=UTF-8

Hi all,

I wrote patch and made adjustment in the RFC
https://wiki.php.net/rfc/script_only_include
https://github.com/php/php-src/pull/1111
Where to check filename extension is subject to be changed.
At first, I thought implementing this as PHP code is good, but
I've changed my mind. It seems better to be done in Zend code.
Opinions are appreciated.

This RFC aims to make PHP as secure as other languages
with respect to "script inclusion" attacks.
Note: File inclusion is not a scope of this RFC.

INI Changes:
 - "php_script" -> "zend.script_extensions"
 - "Allow all files": "*" -> NULL or ""

Open Issues:
 - Error type - Is it OK to raise E_ERROR/E_RECOVERABLE_ERROR in
   zend_language_scanner.c?
 - Vote type - 50%+1 or 2/3

If there is anyone who would like to vote "no" for this RFC,
I would like to know the reason and try to address/resolve issue you have.

Thank you.

Regards,


--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11353862655b70050fb3e8a3--