Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83692
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.51 as permitted sender)
Message-ID: <54ECD4E3.9040705@gmail.com>
Date: Tue, 24 Feb 2015 11:45:39 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: =?UTF-8?B?UMOhZHJhaWMgQnJhZHk=?= <padraic.brady@gmail.com>, 
 Dmitry Stogov <dmitry@zend.com>
CC: Yasuo Ohgaki <yohgaki@ohgaki.net>, 
 "internals@lists.php.net" <internals@lists.php.net>,
 Nikita Popov <nikitappv@gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>	<CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>	<CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com> <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
In-Reply-To: <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: [RFC] Script only include/require
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Will it add a significant level of protection? No.
> 
> Does it add protection? Yes.
> 
> Each time we add some incremental security hardening, we make it a bit
> harder to create vulnerabilities. In this case, if there were code

In this case, it seems not to be much harder than changing an URL a bit
or uploading a file under different extension. OTOH, it creates a false
sense of security - oh, I'm using the secure settings, now I can forget
about caring for LFI! - and also has huge BC break potential. For me, it
looks like magic quotes comeback.

> injection issue, the attacker must a) include a local file (not always
> useful) or b) upload some other apparently innocent file capable of
> being included (extremely useful). As such, this patch would lock out
> an obvious path by restricting the files that can be included to a
> more limited subset.

Unless you disable phar, you can still include pretty much anything by
just using phar includes, as far as I can see. I'm pretty sure there are
also other stream tricks possible (data://? zip://?)

> Enough incremental improvements add up to a significant improvement.

If that were always true, safe mode and magic quotes would still be here
with us.

-- 
Stas Malyshev
smalyshev@gmail.com