Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83738
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.42 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <54ED3F2F.7050203@gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
 <CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
 <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
 <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
 <54ECD4E3.9040705@gmail.com> <CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
 <CAGa2bXZV1FOaW5mJqx2yw7WQz0prp1zfEgdEw99StbWPgDFUwg@mail.gmail.com>
 <54ECFAA8.4020305@gmail.com> <CAGa2bXZ373PGrJtpmgLje3obzGcXQs5sND=8TzyuKac+hZ--Fg@mail.gmail.com>
 <54ED085C.8010901@gmail.com> <CAGa2bXYDGXu3coifbAdLUqE=1qPEJb4RnC_-vWctcrFirc-S6Q@mail.gmail.com>
 <54ED1CE2.9060903@gmail.com> <CAGa2bXaKG3p02Y0X22NP7W=qdO7N4pq8ikqNoF7xm0vUBzMmbg@mail.gmail.com>
 <54ED3F2F.7050203@gmail.com>
Date: Wed, 25 Feb 2015 13:39:55 +0900
Message-ID: <CAGa2bXYsG4fcVL3o_sbpXehL7=3SJ5jdMuPnNe8Sn4f_a1H_XA@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c247aa7d71d9050fe23cf5
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c247aa7d71d9050fe23cf5
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Wed, Feb 25, 2015 at 12:19 PM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> > Are you saying current PHP allows
> > include('zip://...') or include('input://...')?
>
> Neither zip not phar are classified as url handlers. Both have is_url to 0.
>
> > Then this is serious bug. I'll fix it also.
>
> This would be another big BC break, as this would mean you can not use
> phar streams with allow_url_fopen set to off. Please don't change that,
> there's reason for these settings.


I have to at least php://
php://input or php://stdin
allows attacker script execution via POST if it's allowed
by allow_url_include=On.

[yohgaki@dev php-src]$ php -d allow_url_include=On -r
'include("php://input");' 2> /dev/null
[yohgaki@dev php-src]$

No errors. It seems we are better to fix this even with this RFC. Default
setting for web SAPI
prevents attack, but it can be disabled.

Other than this, it seems it's working as it should. (allow_url_include=Off)

[yohgaki@dev php-src]$ php -r 'include("php://input");' 2> /dev/null
Warning: include(php://input): failed to open stream: operation failed in
Command line code on line 1
Warning: include(): Failed opening 'php://input' for inclusion
(include_path='.:/usr/share/pear:/usr/share/php') in Command line code on
line 1

[yohgaki@dev php-src]$ php -r 'include("http://php.net");' 2> /dev/null
Warning: include(): http:// wrapper is disabled in the server configuration
by allow_url_include=0 in Command line code on line 1
Warning: include(http://php.net): failed to open stream: no suitable
wrapper could be found in Command line code on line 1
Warning: include(): Failed opening 'http://php.net' for inclusion
(include_path='.:/usr/share/pear:/usr/share/php') in Command line code on
line 1


Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c247aa7d71d9050fe23cf5--