Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83744
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 209.85.212.173 as permitted sender)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
In-Reply-To: <54ED5648.1020907@gmail.com>
Date: Wed, 25 Feb 2015 09:18:59 +0100
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>,
 =?utf-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>,
 "internals@lists.php.net" <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <0369AE4C-7676-408C-8A6F-16C975588ED5@googlemail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com> <CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com> <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com> <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com> <54ECD4E3.9040705@gmail.com> <CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com> <CAGa2bXZV1FOaW5mJqx2yw7WQz0prp1zfEgdEw99StbWPgDFUwg@mail.gmail.com> <54ECFAA8.4020305@gmail.com> <CAGa2bXZ373PGrJtpmgLje3obzGcXQs5sND=8TzyuKac+hZ--Fg@mail.gmail.com> <54ED085C.8010901@gmail.com> <CAGa2bXYDGXu3coifbAdLUqE=1qPEJb4RnC_-vWctcrFirc-S6Q@mail.gmail.com> <54ED1CE2.9060903@gmail.com> <CAGa2bXaKG3p02Y0X22NP7W=qdO7N4pq8ikqNoF7xm0vUBzMmbg@mail.gmail.com> <54ED3F2F.7050203@gmail.com> <CAGa2bXYsG4fcVL3o_sbpXehL7=3SJ5jdMuPnNe8Sn4f_a1H_XA@mail.gmail.com> <54ED5648.1020907@gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: ingwie2000@googlemail.com ("Kevin Ingwersen (Ingwie Phoenix)")

Here are my cents to this RFC, as it just keeps popping in in my inbox =
and its beginning to be one that I wish I could ignore.

First, =E2=80=A6 file extensions? A default Apache configuration and =
some Nginx configurations actually accept more than one file extension. =
This RFC does not include any way to specify a variety of extensions =
that should be blocked, ignored or treated else.

Your PHP code is only so secure as you make it. If you are in need for =
such an RFC just to block a few =E2=80=9Erare cases=E2=80=9C, then I =
would rather suggest you to either check your source or hand it to a =
professional to get it counter-checked.

Besides of that, it is never a good idea to let a user upload =
/everything/ that they want to. A proper MIME-type check can be helpful =
in these scenarios.

Again, I would not vote for the RFC and I do not think positive about =
it, since I see it very unnecessary.

Thus, if an attacker really wants to get into your business, they have =
more than one way to do so - for instance, exploiting the web server =
itself.

Kind regards,
Ingwie

> Am 25.02.2015 um 05:57 schrieb Stanislav Malyshev =
<smalyshev@gmail.com>:
>=20
> Hi!
>=20
>> I have to at least php://=20
>> php://input or php://stdin=20
>> allows attacker script execution via POST if it's allowed
>> by allow_url_include=3DOn.
>=20
> allow_url_include=3DOn means it's allowed. That's what "on" setting is
> for. Production setting should always be "off".
> --=20
> Stas Malyshev
> smalyshev@gmail.com
>=20
> --=20
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>=20