Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83656
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
	<CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
	<CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
Date: Tue, 24 Feb 2015 11:56:38 +0000
Message-ID: <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
To: Dmitry Stogov <dmitry@zend.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>, 
	Nikita Popov <nikitappv@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: [RFC] Script only include/require
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Dmitry,

On 24 February 2015 at 07:00, Dmitry Stogov <dmitry@zend.com> wrote:
> I'm not a security expert, but I think that adding check for script
> extension won't add significant level of protection.

Will it add a significant level of protection? No.

Does it add protection? Yes.

Each time we add some incremental security hardening, we make it a bit
harder to create vulnerabilities. In this case, if there were code
injection issue, the attacker must a) include a local file (not always
useful) or b) upload some other apparently innocent file capable of
being included (extremely useful). As such, this patch would lock out
an obvious path by restricting the files that can be included to a
more limited subset.

Enough incremental improvements add up to a significant improvement.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com