Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83720
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.43 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <54ECFAA8.4020305@gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
	<CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
	<CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
	<CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
	<54ECD4E3.9040705@gmail.com>
	<CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
	<CAGa2bXZV1FOaW5mJqx2yw7WQz0prp1zfEgdEw99StbWPgDFUwg@mail.gmail.com>
	<54ECFAA8.4020305@gmail.com>
Date: Wed, 25 Feb 2015 00:20:17 +0000
Message-ID: <CALwr1Gne1qf+F+bhgSk-d3undtM-ZDzEpFw=Rzbvt-m2XwPjDQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi,

>> This RFC benefits may not be obvious for people on this list, but this
>> RFC eliminates certain type of "PHP malware". PHP's script inclusion
>
> I can't think of any type of PHP malware that would be eliminated. At
> most, the malware injection protocols have to be slightly modified to
> work around initial hurdle of not being able to pass files with
> extension .php through move_upload_file(). With RCE vulnerability its
> trivial, with RFI one based on uploads it is a little harder, but only
> insignificantly - if I am not mistaken, in the last email I provided a
> workaround and it took me less than 5 minutes to come up with it,
> without being professional exploit writer.

You might want to carefully read Yasuo's sentence about "certain"
types which is not the same as "all" types. You seem to be
exaggerating the claimed benefit of the RFC and using those
exaggerated claims (and their debunking) as evidence against the RFC.
In this, you are seriously off topic. The RFC makes a very simple
claim about limiting includes to specific file extensions. It does not
validate the files - the implicit assumption is the files are
pre-validated so it exists to mop up certain edge cases that may
bypass validation.

This is just basic defense in depth.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com