Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83698
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.47 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
 <CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
 <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
 <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
 <54ECD4E3.9040705@gmail.com> <CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
Date: Wed, 25 Feb 2015 06:15:42 +0900
Message-ID: <CAGa2bXZV1FOaW5mJqx2yw7WQz0prp1zfEgdEw99StbWPgDFUwg@mail.gmail.com>
To: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2e84ae67bf5050fdc07ab
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c2e84ae67bf5050fdc07ab
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Stas,

On Wed, Feb 25, 2015 at 5:33 AM, P=C3=A1draic Brady <padraic.brady@gmail.co=
m>
wrote:

> On Tuesday, February 24, 2015, Stanislav Malyshev <smalyshev@gmail.com>
> wrote:
>
>> Hi!
>>
>> > Will it add a significant level of protection? No.
>> >
>> > Does it add protection? Yes.
>> >
>> > Each time we add some incremental security hardening, we make it a bit
>> > harder to create vulnerabilities. In this case, if there were code
>>
>> In this case, it seems not to be much harder than changing an URL a bit
>> or uploading a file under different extension. OTOH, it creates a false
>> sense of security - oh, I'm using the secure settings, now I can forget
>> about caring for LFI! - and also has huge BC break potential. For me, it
>> looks like magic quotes comeback.
>
>
> They'd need to upload with a matching file type. Instead of any file
> types. Fewer possible types is by definition less than all types.
>
> This is not even remotely magic quotes. No input is altered.
>

I would like to add a note for this.
Anti Virus products are detecting this type of files as "PHP malware".
No other languages have such malware.

According to recent F-Secure blog post, this type of "PHP malware" files
are not decreasing but increasing.  Other than this type of "PHP malware",
"PHP WebShell" is detected as PHP malware by anti virus products.

The reason why these has to detected as "PHP malware" is that there are
PHP programs vulnerable to script inclusion attacks.

Leaving this as it is now would make people think "PHP is insecure than
other languages", "Wow, we have many PHP malware. We may be better
not to use PHP anymore".

If "PHP malware" is found in a server, developers are force to check
their code. Or they have to ask costly code check to people like me,
even when PHP programs is safe. If this RFC is accepted, developers
can prove their PHP programs are safe without code check.

This RFC benefits may not be obvious for people on this list, but this
RFC eliminates certain type of "PHP malware". PHP's script inclusion
is a toy for security researcher and attackers for a long time.
Let's take away the toy from them.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c2e84ae67bf5050fdc07ab--