Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83818
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <0369AE4C-7676-408C-8A6F-16C975588ED5@googlemail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
	<CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
	<CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
	<CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
	<54ECD4E3.9040705@gmail.com>
	<CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
	<CAGa2bXZV1FOaW5mJqx2yw7WQz0prp1zfEgdEw99StbWPgDFUwg@mail.gmail.com>
	<54ECFAA8.4020305@gmail.com>
	<CAGa2bXZ373PGrJtpmgLje3obzGcXQs5sND=8TzyuKac+hZ--Fg@mail.gmail.com>
	<54ED085C.8010901@gmail.com>
	<CAGa2bXYDGXu3coifbAdLUqE=1qPEJb4RnC_-vWctcrFirc-S6Q@mail.gmail.com>
	<54ED1CE2.9060903@gmail.com>
	<CAGa2bXaKG3p02Y0X22NP7W=qdO7N4pq8ikqNoF7xm0vUBzMmbg@mail.gmail.com>
	<54ED3F2F.7050203@gmail.com>
	<CAGa2bXYsG4fcVL3o_sbpXehL7=3SJ5jdMuPnNe8Sn4f_a1H_XA@mail.gmail.com>
	<54ED5648.1020907@gmail.com>
	<0369AE4C-7676-408C-8A6F-16C975588ED5@googlemail.com>
Date: Wed, 25 Feb 2015 19:39:45 +0000
Message-ID: <CALwr1Gn-J8QDwQ8yCxpmgYBcBJYxo-LBjcuM_YT7WxCvzN5pCA@mail.gmail.com>
To: "Kevin Ingwersen (Ingwie Phoenix)" <ingwie2000@googlemail.com>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, Yasuo Ohgaki <yohgaki@ohgaki.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Kevin,

On 25 February 2015 at 08:18, Kevin Ingwersen (Ingwie Phoenix)
<ingwie2000@googlemail.com> wrote:
> Here are my cents to this RFC, as it just keeps popping in in my inbox an=
d its beginning to be one that I wish I could ignore.
>
> First, =E2=80=A6 file extensions? A default Apache configuration and some=
 Nginx configurations actually accept more than one file extension. This RF=
C does not include any way to specify a variety of extensions that should b=
e blocked, ignored or treated else.

Er...it has an ini setting to create the whitelist? Also, blacklists
would never work - there might as well be an infinite number of file
extensions.

> Your PHP code is only so secure as you make it. If you are in need for su=
ch an RFC just to block a few =E2=80=9Erare cases=E2=80=9C, then I would ra=
ther suggest you to either check your source or hand it to a professional t=
o get it counter-checked.

So it does block "rare cases"? I dislike assigning rarity to security
issues since that assumes we have actual hard data when we don't. All
I can say definitively is that certain exploits in the area have been
around since 2010. Most of the close-to-php reporting I've seen
arrives around 2012. However, playing a numbers game about whether to
implement a security protection or not is irrelevant. Either it is a
security issue or it is not. It is.

Getting your code audited is always a good idea, of course.

> Besides of that, it is never a good idea to let a user upload /everything=
/ that they want to. A proper MIME-type check can be helpful in these scena=
rios.

PHP via EXIF jpeg field. MIME check would detect it as image/jpeg.
Crackers have been using it in the wilds for years. MIME check of
Stanislav's PHAR as a GIF would be detected as application/gzip for
comparison since it's not a valid image.

> Again, I would not vote for the RFC and I do not think positive about it,=
 since I see it very unnecessary.
>
> Thus, if an attacker really wants to get into your business, they have mo=
re than one way to do so - for instance, exploiting the web server itself.

This last sentence is true enough. For some reason though, we still
fix other entirely unrelated security weaknesses in PHP itself...

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com