Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83633
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain zend.com designates 209.85.220.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
	<CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
Date: Tue, 24 Feb 2015 11:00:02 +0400
Message-ID: <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>, Nikita Popov <nikitappv@gmail.com>
Content-Type: multipart/alternative; boundary=20cf3071c7c0598907050fd011b8
Subject: Re: [RFC] Script only include/require
From: dmitry@zend.com (Dmitry Stogov)

--20cf3071c7c0598907050fd011b8
Content-Type: text/plain; charset=UTF-8

On Mon, Feb 23, 2015 at 6:55 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Dmitry and Nikita,
>
> On Mon, Feb 23, 2015 at 6:23 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> I wrote patch and made adjustment in the RFC
>> https://wiki.php.net/rfc/script_only_include
>> https://github.com/php/php-src/pull/1111
>> Where to check filename extension is subject to be changed.
>> At first, I thought implementing this as PHP code is good, but
>> I've changed my mind. It seems better to be done in Zend code.
>> Opinions are appreciated.
>>
>> This RFC aims to make PHP as secure as other languages
>> with respect to "script inclusion" attacks.
>> Note: File inclusion is not a scope of this RFC.
>>
>> INI Changes:
>>  - "php_script" -> "zend.script_extensions"
>>  - "Allow all files": "*" -> NULL or ""
>>
>> Open Issues:
>>  - Error type - Is it OK to raise E_ERROR/E_RECOVERABLE_ERROR in
>>    zend_language_scanner.c?
>>  - Vote type - 50%+1 or 2/3
>>
>> If there is anyone who would like to vote "no" for this RFC,
>> I would like to know the reason and try to address/resolve issue you have.
>>
>> Thank you.
>>
>
> We don't have care much about which error is raised from Zend engine,
> since there
> will be engine exception.
>
> My questions are, is it ok to raise E_ERROR or E_RECOVERABLE_ERROR from
> zend_language_scanner.c?
>

Use E_ERROR.


>
>
> https://github.com/php/php-src/pull/1111/files#diff-93ad74868f98ff7232ebea00007c8b7fR624
>
> Does engine exception catches error from zend_error_noreturn()?
>

no. it'll be changed into zend_error().

I'm not a security expert, but I think that adding check for script
extension won't add significant level of protection.

Thanks. Dmitry.


>
> Thank you.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
>

--20cf3071c7c0598907050fd011b8--