Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83696
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <54ECD4E3.9040705@gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
	<CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
	<CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
	<CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
	<54ECD4E3.9040705@gmail.com>
Date: Tue, 24 Feb 2015 20:33:17 +0000
Message-ID: <CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Dmitry Stogov <dmitry@zend.com>, Yasuo Ohgaki <yohgaki@ohgaki.net>, 
	"internals@lists.php.net" <internals@lists.php.net>, Nikita Popov <nikitappv@gmail.com>
Content-Type: multipart/alternative; boundary=089e0112d166c19ed9050fdb6dd2
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

--089e0112d166c19ed9050fdb6dd2
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi

On Tuesday, February 24, 2015, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Hi!
>
> > Will it add a significant level of protection? No.
> >
> > Does it add protection? Yes.
> >
> > Each time we add some incremental security hardening, we make it a bit
> > harder to create vulnerabilities. In this case, if there were code
>
> In this case, it seems not to be much harder than changing an URL a bit
> or uploading a file under different extension. OTOH, it creates a false
> sense of security - oh, I'm using the secure settings, now I can forget
> about caring for LFI! - and also has huge BC break potential. For me, it
> looks like magic quotes comeback.


They'd need to upload with a matching file type. Instead of any file types.
Fewer possible types is by definition less than all types.

This is not even remotely magic quotes. No input is altered.


>
> > injection issue, the attacker must a) include a local file (not always
> > useful) or b) upload some other apparently innocent file capable of
> > being included (extremely useful). As such, this patch would lock out
> > an obvious path by restricting the files that can be included to a
> > more limited subset.
>
> Unless you disable phar, you can still include pretty much anything by
> just using phar includes, as far as I can see. I'm pretty sure there are
> also other stream tricks possible (data://? zip://?)


None of this detracts from limiting file includes. Other potential
weaknesses could be addressed separately if you agree there's more than one
addressed not addressed here. One might say...incrementally.

Also, we are obviously talking about PHP includes with this RFC...


> > Enough incremental improvements add up to a significant improvement.
>
> If that were always true, safe mode and magic quotes would still be here
> with us.
>

You keep mentioning magic quotes. That was never an improvement. It was
removed from PHP. Please stop trying to associate two unrelated things to
establish bad practice by word proximity. The sentence is obviously true.

Paddy




--=20

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative

--089e0112d166c19ed9050fdb6dd2--