Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83719
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <54ECF605.7030506@gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
	<CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
	<CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
	<CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
	<54ECD4E3.9040705@gmail.com>
	<CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
	<54ECF605.7030506@gmail.com>
Date: Wed, 25 Feb 2015 00:09:39 +0000
Message-ID: <CALwr1GkU_mumpp-34Pp=gKwZzL3KVEW7JpEnqC5MMtcgM_qEbA@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Dmitry Stogov <dmitry@zend.com>, Yasuo Ohgaki <yohgaki@ohgaki.net>, 
	"internals@lists.php.net" <internals@lists.php.net>, Nikita Popov <nikitappv@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi,

On 24 February 2015 at 22:07, Stanislav Malyshev <smalyshev@gmail.com> wrot=
e:
> Hi!
>
>> They'd need to upload with a matching file type. Instead of any file
>
> Not sure what you mean by that. phar can read tars, etc. AFAIK, can't
> it? Also, phar archive has no requirement of being named something.phar,
> afaik can be also named cuteponies.gif. E.g., I just did this:

Your example omitted the image validation step which would have
noticed your attempt to upload a phar immediately. Add that and try
again. It's not very fair to create a scenario with a total lack of
any security, and then ignore that your code's problem is that gaping
hole and NOT the minor extension filter on the far end.

The control under debate was already provided with a preventable
example by Yasuo pointing out how certain crafted images for file
inclusion, which would bypass certain image validation checks, would
indeed be preventable by his RFC. Please stick to what the RFC
actually claims to do.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com